Skip links

Collisions during UUID generation in SAP NetWeaver Java Server, SAP security note 2499109

Description

NW Java Server random number generator is broken (race condition in parallel threads):

  • Two requestors of a random number might get the same “random” number.
  • An exception might occur in the random number generator

This can result in several security and functional issues:

  • UUID collision is possible.
  • Cryptographic key generated by NW Java Server might be broken
  • Two different sessions might have identical Session IDs. Session hijacking might be possible
  • Functional error like “HTTP Error 500”, “This page isn’t working” or similar after login to Netweaver/Portal
  • Output like “500 Internal Server Error” instead of Logon Dialog in Netweaver/Portal
  • Error of type GC Allocation Failure
  • Outgoing TLS connections fail with various exceptions during key generation

CVSS Information

CVSS v3 Base Score: 6.8 / 10
CVSS v3 Base Vector:

AV : Attack Vector (Related exploit range)

Network (N)

AC : Attack Complexity (Required attack complexity)

Low (L)

PR : Privileges Required (Level of privileges needed to exploit)

Low (L)

UI : User Interaction (Required user participation)

Required (R)

S : Scope (Change in scope due to impact caused to components beyond the vulnerable component)

Unchanged (U)

C : Impact to Confidentiality

High (H)

I : Impact to Integrity

Low (L)

A : Impact to Availability

Low (L)

SAP provides this CVSS v3 base score as an estimate of the risk posed by the issue reported in this note. This estimate does not take into account your own system configuration or operational environment. It is not intended to replace any risk assessments you are advised to conduct when deciding on the applicability or priority of this SAP security note. For more information, see the FAQ section at https://support.sap.com/securitynotes.

Available fix and Supported packages

  • CORE-TOOLS | 7.50 | 7.50
  • J2EE ENGINE CORE TOOLS 7.50 | SP006 | 000003
  • J2EE ENGINE CORE TOOLS 7.50 | SP007 | 000002
  • J2EE ENGINE CORE TOOLS 7.50 | SP008 | 000001
  • J2EE ENGINE CORE TOOLS 7.50 | SP009 | 000000
  • J2EE ENGINE CORE TOOLS 7.50 | SP010 | 000000

Affected component

    BC-JAS-SEC-CPG
    Cryptography

CVSS

Score: 0

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/2499109

TAGS

#UUID
#&160-engineNextBytes
#&160-SecRandomSpi
#SecureRandom
#Session-ID