SAP Security Note
Medium priority
SAP security note 1628711, "Unauthorized modification of NWBC binaries", is a program error note released on 14.08.2012. Below are the symptom, SAP recommended solution and reason for this note.
Description
Symptom
A malicious user can modify NWBC binaries and thus inject malicious code. The malicious user can control the behavior of the system, or potentially escalate privileges if their code is executed.
Solution
This vulnerability is fixed with NWBC 3.5 SP0 PL1. Integrity checks are performed.
Reason and prerequisites
NWBC binaries are shipped without integrity protection. As a result, a malicious user can modify binaries. This may result in undesired system behavior.
Full note on SAP: SAP Support Launchpad note 1628711
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].