SAP Security Notes June 2015

[Darya Maenkova <d.maenkova () erpscan com>]

SAP <http://www.sap.com/>has released the monthly critical patch update 
for June 2015. This patch update closes a lot of vulnerabilities in SAP 
products. The most popular vulnerability is Missing Authorization Check. 
This month, three critical vulnerabilities found by ERPScan researchers 
Vahagn Vardanyan, Rustem Gazizov, and Diana Grigorieva were closed.

*Issues that were patched with the help of ERPScan*

Below are the details of SAP vulnerabilities that were found byERPScan 
<http://www.erpscan.com/>researchers.

 * An XML eXternal Entity vulnerability in SAP Mobile Platform
   on-premise (CVSS Base Score:5.5).Updateis available in SAP Security
   Note2159601 <https://service.sap.com/sap/support/notes/2159601>. An
   attacker can use XML eXternal Entities to send specially crafted
   unauthorized XML requests, which will be processed by the XML
   parser. The attacker will get unauthorized access to the OS file system.
 * A Hardcoded Credentials vulnerability in SAP Cross-System Tools
   (CVSS Base Score:3.6).Updateis available in SAP Security Note2059659
   <https://service.sap.com/sap/support/notes/2059659>. An attacker can
   use hardcoded credentials for unauthorized access and perform
   various actions in the system. In addition, it is likely that the
   code will be implemented as a backdoor into the system.
 * A Hardcoded Credentials vulnerability in SAP Data Transfer Workbench
   (CVSS Base Score:2.1).Updateis available in SAP Security Note2057982
   <https://service.sap.com/sap/support/notes/2057982>. An attacker can
   use the hardcoded credentials for unauthorized access and perform
   various actions in the system. In addition, it is likely that the
   code will be implemented as a backdoor into the system.


*The most critical issues found by other researchers*

Some of our readers and clients asked us to categorize the most critical 
SAP vulnerabilities to patch them first. Companies providing SAP 
Security Audit, SAP Security Assessment, or SAP Penetration Testing 
services can include these vulnerabilities in their checklists. The most 
critical vulnerabilities of this update can be patched by the following 
SAP Security Notes:

 * 2151237 <https://service.sap.com/sap/support/notes/2151237>: SAP GUI
   for Windows has a Buffer Overflow vulnerability (CVSS Base
   Score:9.3). An attacker can use Buffer Overflow for injecting
   specially crafted code into working memory, which will be executed
   by the vulnerable application under the privileges of that
   application. This can lead to the attacker taking complete control
   over the application, denial of service, command execution, and
   other attacks. In case of command execution,attackercan obtain
   critical technical and business-related information stored in the
   vulnerable SAP-system or escalate their own privileges. As for
   denial of service, the process of the vulnerable component may be
   terminated. For this time, nobody will be able to use this service,
   which negatively influences business processes, system downtime,
   and, consequently, business reputation. It is recommended to install
   this SAP Security Note to prevent risks.
 * 2129609 <https://service.sap.com/sap/support/notes/2129609>: SAP EP
   JDBC Connector has an SQL Injection vulnerability (CVSS Base
   Score:6.5). An attacker can use SQL Injections with the help of
   specially crafted SQL queries. They can read and modify sensitive
   information from a database, execute administrative operations in a
   database, destroy data or make it unavailable. In some cases, an
   attacker can access system data or execute OS commands. It is
   recommended to install this SAP Security Note to prevent risks.
 * 1997734 <https://service.sap.com/sap/support/notes/1997734>: SAP RFC
   runtime has a Missing AuthorizationXheckvulnerability (CVSS Base
   Score:6.0). An attacker can use Missing Authorization Checks to
   access a service without any authorization procedures and use
   service functionality that has restricted access. This can lead to
   information disclosure, privilege escalation, and other attacks. It
   is recommended to install this SAP Security Note to prevent risks.
 * 2163306 <https://service.sap.com/sap/support/notes/2163306>: SAP
   CommonCryptoLib and SAPCRYPTOLIB are vulnerable to FREAK
   (CVE-2015-0204, CVSS Base Score:5.0). It allows an attacker to
   intercept HTTPS connections between vulnerable clients and servers
   and force them to use weakened encryption, which the attacker can
   break to steal or manipulate sensitive data. All the attacks on this
   page assume a network adversary (i.e. a man-in-the-middle) to tamper
   with TLS handshake messages. The typical scenario to mount such
   attacks is by tampering with the Domain Name System (DNS), for
   example via DNS rebinding or domain name seizure. This attack
   targets a class of deliberately weak export cipher suites. It is
   recommended to install this SAP Security Note to prevent risks.


*References about the FREAK vulnerability:*

 * SMACK: State Machine AttaCKs <https://www.smacktls.com/>
 * Tracking the FREAK Attack <https://freakattack.com/>
 * CVE-2015-0204
   <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0204>


It is highly recommended to patch all those SAP vulnerabilities to 
prevent business risks affecting your SAP systems.

SAP has traditionally thanked the security researchers from ERPScan for 
found vulnerabilities on theiracknowledgment page 
<http://scn.sap.com/docs/DOC-8218>.

Advisories for those SAP vulnerabilities with technical details will be 
available in 3 months onerpscan.com <http://www.erpscan.com/>.


_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/