SAP security note 1481923, "Possible execution of arbitrary commands in RFC SDK tools", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
An attacker can exploit a memory corruption in the tools of the RFC SDK on the client to change the program run so that arbitrary commands are executed. As a result, all data of this tool can be seen, deleted, or changed.
Solution
If possible, do not use the sample programs of the RFC SDK. For more information, see Note 1140031. The aforementioned problems do not occur with the latest versions of the RFC SDK:
- RFCSDK for 6.40 patch level 50
- RFCSDK for 7.00 patch level 25
- RFCSDK for 7.10 patch level 21
- RFCSDK for 7.11 patch level 8
Although all versions of the RFC SDK are fundamentally compatible, it is recommended to use only the latest release of the RFC SDK, currently from June 2010 (version 7.11). For more information, see Note 1445409.
Reason and prerequisites
Sample programs of the RFC SDK on the client exhibit a vulnerability with which a memory overflow can be provoked. An attacker can insert their own commands in the memory area of the process that is running and execute them. It is also possible that only one memory protection violation is triggered, resulting in the program being terminated.
References
- Procedure for security problem using RFC Lib or RFC SDK (1445409)
- Security Note: rfcexec/startrfc Used in File Interfaces (1140031)
Full note on SAP: SAP Support Launchpad note 1481923
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
