SAP security note 2117322, “SAP BusinessObjects WACS is vulnerable to POODLE attacks”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The Web Application Container Service (WACS) in SAP BusinessObjects systems is vulnerable to POODLE attacks (CVE-2014-3566).
Solution
The Web Application Container Service has been updated to ensure that selecting “TLS” as the Protocol in the service configuration properties (e.g., on the Server Properties page in the CMS for the Web Application Container Server) will enable only TLS protocols and disable SSL 3.0. As a result, client applications that do not support TLS will no longer be able to access the service when its protocol is set to “TLS”.
Reason and prerequisites
The Web Application Container Service can fall back to SSL 3.0 when its Protocol option is set to “TLS”. This fallback mechanism makes network connections to the service vulnerable to POODLE attacks.
Affected components
- XI 3.1: Patches 6.6 and 7.3
- BI 4.0: Patches 9.10, 10.5, 11.1, and SP12
- BI 4.1: Patches 3.10, 4.7, 5.3, and SP06
- Subsequent releases: all later versions are also affected and patched.
Full note on SAP: SAP Support Launchpad note 2117322
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].