SAP Note 2140700
SAP security note 2140700, "Potential termination of HANA client (hdbsql)", is released on April 14, 2015. Below are the symptom and SAP recommended solution.
Description
Symptom
An attacker who can start hdbsql can crash it by specifying invalid command line parameters, causing the process to terminate. This requires manual restart of the process.
Solution
Upgrade your SAP HANA Client packages to:
- Revision ≥ 85.02 (Version 1.00.85.02.399857 for SPS08)
- Revision ≥ 93 (Version 1.00.093.00.1424770727 for SPS09)
No need to update the SAP HANA database server packages. You can determine the version of your client package by executing hdbsql -v or hdbsqldbc_cons.
CVSS
Score 3.6
Full note on SAP: SAP Support Launchpad note 2140700
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].