SAP Note 1438399SAP Security Note
SAP security note 1438399, “Security hole in program ssfrfc on the application server”, is published by SAP for the affected component listed below. The description reproduces the information SAP released for this note.
Description
Due to a security hole in the program ssfrfc on the application server, malicious users may obtain control of an SAP system.
CVSS
Score 0
Affected components
- SAP_BASIS | 46A | 46D
- SAP_BASIS | 610 | 640
- SAP_BASIS | 700 | 702
- SAP_BASIS | 710 | 711
- SAP KERNEL 4.6D_EX2 32-BIT | SP2513 | 002513
- SAP KERNEL 4.6D_EX2 64-BIT | SP2513 | 002513
- SAP KERNEL 4.6D_EXT 32-BIT | SP2513 | 002513
- SAP KERNEL 4.6D_EXT 64-BIT | SP2513 | 002513
- SAP KERNEL 6.40 32-BIT | SP320 | 000320
- SAP KERNEL 7.00 32-BIT | SP245 | 000245
- SAP KERNEL 7.00 32-BIT UNICODE | SP245 | 000245
- SAP KERNEL 7.00 64-BIT | SP245 | 000245
- SAP KERNEL 7.00 64-BIT UNICODE | SP245 | 000245
- SAP KERNEL 7.01 32-BIT | SP082 | 000082
- SAP KERNEL 7.01 32-BIT UNICODE | SP082 | 000082
- SAP KERNEL 7.01 64-BIT | SP082 | 000082
- SAP KERNEL 7.01 64-BIT UNICODE | SP082 | 000082
- SAP KERNEL 7.10 32-BIT | SP189 | 000189
- SAP KERNEL 7.10 32-BIT UNICODE | SP189 | 000189
- SAP KERNEL 7.10 64-BIT | SP189 | 000189
Full note on SAP: SAP Support Launchpad note 1438399
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
