CERT-In Advisory
CIAD-2019-0029
Multiple Vulnerabilities in SAP products
Original Issue Date: August 21, 2019
Severity Rating: High
Software Affected
- SAP NetWeaver UDDI Server (Services Registry), Versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50
- SAP Commerce Cloud (mediaconversion and virtualjdbc extension), Versions - 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905
SAP NetWeaver Application Server for Java (Administrator System Overview), Versions - 7.30, 7.31, 7.40, 7.50
- SAP HANA Database, Versions - 1.0, 2.0
- SAP Kernel (ABAP Debugger), Versions - KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.73, KERNEL 7.21, 7.49, 7.53, 7.73, 7.75, 7.76, 7.77
- SAP Business Objects Business Intelligence Platform (Web Intelligence and CMC), Version - 4.2
- SAP Enable Now, Version - 1902
- SAP NetWeaver Process Integration (Java Proxy Runtime), Versions - 7.10, 7.11, 7.30, 7.31, 7.40, 7.50
- SAP BusinessObjects Business Intelligence Platform (BI Workspace, Infoview and CMC), Versions - 4.1, 4.2, 4.3
- SAP Gateway, Versions - 750, 751, 752, 753
Overview
Multiple vulnerabilities have been reported in SAP products, which could be exploited by a remote attacker to execute arbitrary code, inject malicious code, obtain sensitive information, cause denial of service conditions, perform cross site scripting attacks or perform other unauthorized activities on a targeted system.
Description
These vulnerabilities exist in SAP products due to unsafe deserialization error, insufficient encoding of user-controlled inputs, absence of HTTP Only flag in session cookie, incorrect hardening of the XML Parser, unencrypted communication error and other flaws in the affected software. A remote attacker can exploit these vulnerabilities by injecting malicious code, sending a specially crafted XML file, executing a "Go to statement", performing unauthorized queries, running/storing a malicious script or payload, giving a payload as keyword in the search and via other attack vectors.
Successful exploitation of these vulnerabilities could allow the attacker to execute arbitrary code, inject malicious code, obtain sensitive information, cause denial of service conditions, perform cross site scripting attacks or perform other unauthorized activities on a targeted system.
Solution
Apply appropriate patches as mentioned on SAP website:
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017
Vendor Information
SAP
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017
References
SAP
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=523998017
Onapsis
https://www.onapsis.com/blog/sap-security-notes-august-19-sap-java-systems-continuity-risk-unauthenticated-attack
CVE Name
CVE-2019-0351
CVE-2019-0344
CVE-2019-0343
CVE-2019-0345
CVE-2019-0350
CVE-2019-0349
CVE-2019-0333
CVE-2019-0346
CVE-2019-0340
CVE-2019-0341
CVE-2019-0337
CVE-2019-0334
CVE-2019-0338
CVE-2019-0331
CVE-2019-0332
CVE-2019-0335
CVE-2019-0348
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|