[ESNC-2013-003] Remote OS Command Execution in SAP BASIS Communication Services

[ESNC Security <secure () esnc de>]

 [ESNC-2013-003] Remote OS Command Execution in SAP BASIS Communication
Services

Please refer to www.esnc.de for the original security advisory, updates and
additional information.
------------------------------------------------------------------------
1. Business Impact
------------------------------------------------------------------------

This vulnerability allows executing arbitrary operating system commands on
the remote SAP system with the rights of the SAP application user.

By exploiting this vulnerability, an attacker can take complete control of
the SAP application and data remotely via e.g. RFC protocol or over the web
via SAP's RFC-SOAP interfaces. Attacker can therefore manipulate/extract
business data and control the business logic.

Although vendor claims confidentiality, integrity and availability is only
partially affected (C:P/I:P/A:P) resulting a CVSS score of 6.0, we believe
this does not reflect the actual risk.

*Risk Level: High*
------------------------------------------------------------------------
2. Advisory Information
------------------------------------------------------------------------

-- ESNC Security Advisory ID: ESNC-2013-003
-- CVE ID: CVE-2013-3063
-- Original security advisory:
http://www.esnc.de/sap-security-audit-and-scan-services/security-advisories/39-remote-code-execution-in-sap-connect-communication-services
-- Reporting Date: 05.09.2011
-- Vendor Patch Date: 08.01.2013
-- Public Advisory Date: 16.04.2013
-- Researcher: Ertunga Arsal
------------------------------------------------------------------------
3. Vulnerability Information
------------------------------------------------------------------------

-- Vendor: SAP
-- Affected Components: Basis Components- Communication Services
-- Affected Versions: 4.6B-7.30 - Please refer to SAP note for more
information
-- Vulnerability Class: Remote Operating System Command Injection
-- CVSS v2 score by the vendor: 6.0 (AV:N/AC:M/AU:S/C:P/I:P/A:P)
-- Remotely Exploitable: Yes
-- Authentication Required: Yes
-- Additional Notes: An exploit for this vulnerability is available in ESNC
Penetration Testing Suite
------------------------------------------------------------------------
4. Solution
------------------------------------------------------------------------

Please apply the security patch [SAP Note 1674132] supplied by the vendor.
More information can be found at vendor's site:

https://service.sap.com/sap/support/notes/1674132
------------------------------------------------------------------------
About ESNC
------------------------------------------------------------------------

ESNC GmbH, Germany is a company specialized in SAP security audit, SAP
penetration testing, ABAP security review and SAP vulnerability assessment
services.

It's flagship product ESNC Security Suite is used by many large enterprises
for vulnerability scanning their SAP ABAP and Java systems, running ABAP
code security reviews, enforcing SAP security baselines and managing
compliance.

For more information about our products and services, please visit our web
page at www.esnc.de

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/