SAP security note 1151410, "Potential remote termin. of running processes in sapstarsrv", is a program error note released on 14.09.2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can remotely exploit the sapstartsrv process to manually terminate it.
Solution
The solution is available under "SP Patch Level".
Reason and prerequisites
The issue is caused by a memory corruption that results in the termination of the process. An attacker can provoke a condition in which the process attempts to read outside its memory space, which causes a memory protection fault. This results in the process being terminated, rendering the application unusable until a manual restart.
Affected components
- KRNL32NUC 6.40
- KRNL32NUC 7.00
- KRNL32UC 6.40
- KRNL32UC 7.00
- KRNL64NUC 6.40
- KRNL64NUC 7.00
- KRNL64UC 6.40
- KRNL64UC 7.00
Full note on SAP: SAP Support Launchpad note 1151410
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].