-----BEGIN PGP SIGNED MESSAGE-----
Onapsis Security AdvisoryONAPSIS-2015-007: SAP HANA Log Injection
1. Impact on Business
Under certain conditions the SAP HANA XS engine is vulnerable to
injection, allowing remote authenticated attackers to write arbitrary
information in log files.
This could be used to corrupt log files or add fake content misleading
Risk Level: Medium
2. Advisory Information
- - Public Release Date: 2015-05-27
- - Subscriber Notification Date: 2015-05-27
- - Last Revised: 2015-05-27
- - Security Advisory ID: ONAPSIS-2015-007
- - Onapsis SVS ID: ONAPSIS-00140
- - CVE: CVE-2015-3994
- - Researcher: Fernando Russ, Nahuel D. Snchez
- - Initial Base CVSS v2: 4.0 (AV:N/AC:L/Au:S/C:N/I:P/A:N)
3. Vulnerability Information
- - Vendor: SAP A.G.
- - Affected Components: SAP HANA DB 1.00.73.00.389160 (NewDB100_REL)
- - Vulnerability Class: Improper Output Neutralization for Logs (CWE-117)
- - Remotely Exploitable: Yes
- - Locally Exploitable: No
- - Authentication Required: Yes
- - Original Advisory:
4. Affected Components Description
SAP HANA is a platform for real-time business. It combines database,
data processing, and application platform capabilities in-memory. The
platform provides libraries for predictive, planning, text processing,
spatial, and business analytics.
5. Vulnerability Details
Under certain conditions a remote authenticated attacker can inject log
lines performing specially crafted HTTP requests to the vulnerable SAP
HANA XS Engine.
The vulnerable application is ?grant.xsfunc?, located under:
Implement SAP Security Note 2109818
7. Report Timeline
2014-10-03: Onapsis provides vulnerability information to SAP AG.
2014-11-07: Onapsis provides additional information about the
vulnerability to SAP AG.
2015-01-26: Onapsis provides additional information about the
vulnerability to SAP AG.
2015-02-10: SAP AG publishes security note 2109818 which fixes the problem.
2015-05-27: Onapsis publishes security advisory.
Organizations depend on Onapsis because of our ability to provide
reliable expertise and solutions for securing business essentials
About Onapsis Research Labs
Onapsis Research Labs provides the industry analysis of key security
issues that impact business-critical systems and applications.
Delivering frequent and timely security and compliance advisories with
associated risk levels, Onapsis Research Labs combine in-depth knowledge
and experience to deliver technical and business-context with sound
security judgment to the broader information security community.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (GNU/Linux)
Comment: Onapsis Research Team
-----END PGP SIGNATURE-----