Untrusted XML input parsing possible in Configuration Wizard, SAP security note 2235994

SAP security note 2235994, “Untrusted XML Input Parsing Possible in Configuration Wizard”, is a program error note released on 08.03.2016. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A vulnerability exists in the Configuration Wizard due to incorrect usage of an XML parser. An attacker can modify an XML-based request to include malicious XML content that is parsed locally. This can lead to:

• Denial of Service (DoS): Rendering the parsing system temporarily unavailable.
• Information Disclosure: Local data may be disclosed in the response to the malicious request.
• Unauthorized Access: Access to network-located resources accessible from the parsing system.

Solution

Update AS Java to a Support Package (SP) or release where the issue is fixed. Refer to the Support Package Patch Level section below for details and available patches.

Reason and prerequisites

The issue is caused by a program error in the Configuration Wizard due to incorrect use of an XML parser. By default, the parser opens external entities referenced within an XML input, allowing malicious content to be parsed. This malicious content can reference internal resources, such as files, which can be disclosed in the response or used to perform a DoS attack on the parsing system.

CVSS

Score 6.4 / 10 Vector: AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

References

Affected components

• LM-TOOLS (7.00 to 7.02)
• LMCTC (7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50)