Potential remote code execution in SAP Startup Service, SAP security note 1638811

SAP security note 1638811, "Potential remote code execution in SAP Startup Service", is a note. Below are the symptom, SAP recommended solution, CVSS details, references and the affected software components.

Description

Symptom

This security note has been updated. For more detailed information, see Security Note 1651809.

An attacker can exploit the SAP Startup Service to enable them to take complete control of the product, including viewing, changing, or deleting data.

Solution

The error in sapstartsrv is corrected as of the following releases and patch levels:

• Release 711 patch level 146
• Release 720 patch level 109
• Release 800 patch level 43
• Release 802 patch level 21

Apply the relevant kernel patch level or host agent patch.

Reason and prerequisites

A buffer overflow vulnerability exists in the SAP Startup Service. This enables an attacker to inject code into the working memory that is subsequently executed by the application. It can also be used to cause a general fault in the product, causing the product to terminate.

CVSS

Score 6.8 Vector: AV:N/AC:M/AU:N/C:P/I:P/A:P

References

• Security Note 1651809 – Update #1 to Security Note 1638811
• Installing Package SAPHOSTAGENT (1031096)
• Downloading SAP kernel patches (19466)

Affected components

• SAP_BASIS: 711 to 720, 800 to 802
• SAPHOSTAGENT: 7.11 and 7.20