Potential information disclosure relating to server information, SAP security note 2176128

SAP security note 2176128, "Potential information disclosure relating to server information", is a program error note released on 11.08.2015. Below are the symptom and the SAP recommended solution.

Description

Symptom

An attacker can discover server-related information of SAP HANA and SAP HANA Extended Application Services. This information could be used to allow the attacker to specialize their attacks against SAP HANA and SAP HANA Extended Application Services.

Solution

The issue has been fixed with SAP HANA SPS 09 Database Revision 95. Apply this or later revisions.

Alternatively, perform the following workaround for SAP HANA SPS 09 Database Revision 90 – 94:

• Create a configuration file (e.g., in /usr/sap/<SID>/<host>/wdisp) with the following content: RegIForbiddenUrl ^/sap/hana/xs/internal/(.*) –
• Update webdispatcher.ini: add the following line to the [profile] section: icm/HTTP/mod_15 = PREFIX=/sap/hana/xs/internal/, FILE=<path and name of the created file>
• Restart the Web Dispatcher process: webdispatcher / hdbwebdispatcher

For SAP HANA SPS 08 and lower, follow these steps:

• Create a configuration file (e.g., in /usr/sap/<SID>/<host>/wdisp) with the following content: RegIForbiddenUrl ^/sap/hana/xs/internal/(.*) –
• Update sapwebdisp.pfl: add the following line to /usr/sap/<SID>/<host>/wdisp/sapwebdisp.pfl: icm/HTTP/mod_15 = PREFIX=/sap/hana/xs/internal/, FILE=<path and name of the created file>
• Restart the SAP Web Dispatcher process: sapwebdisp_hdb. The process cannot be restarted via the SAP HANA Studio; it must be stopped directly from the operating system.

This solution affects the SAP Web Dispatcher if it is used as an HTTP load balancer. Refer to SAP Note 2146931 for more details.

Reason and prerequisites

Information such as landscape configuration data can be discovered using SAP HANA Extended Application Services. This information may be used by an attacker to further target SAP HANA and SAP HANA Extended Application Services.

CVSS

Score 5.0 / 10 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

References

• 2146931 – Web Dispatcher – XSSRV – Initialization fails because access to topology information is forbidden