SAP <http://www.sap.com/>has released the monthly critical patch update
for June 2015. This patch update closes a lot of vulnerabilities in SAP
products. The most popular vulnerability is Missing Authorization Check.
This month, three critical vulnerabilities found by ERPScan researchers
Vahagn Vardanyan, Rustem Gazizov, and Diana Grigorieva were closed.
*Issues that were patched with the help of ERPScan*
Below are the details of SAP vulnerabilities that were found byERPScan
<http://www.erpscan.com/>researchers.
* An XML eXternal Entity vulnerability in SAP Mobile Platform
on-premise (CVSS Base Score:5.5).Updateis available in SAP Security
Note2159601 <https://service.sap.com/sap/support/notes/2159601>. An
attacker can use XML eXternal Entities to send specially crafted
unauthorized XML requests, which will be processed by the XML
parser. The attacker will get unauthorized access to the OS file system.
* A Hardcoded Credentials vulnerability in SAP Cross-System Tools
(CVSS Base Score:3.6).Updateis available in SAP Security Note2059659
<https://service.sap.com/sap/support/notes/2059659>. An attacker can
use hardcoded credentials for unauthorized access and perform
various actions in the system. In addition, it is likely that the
code will be implemented as a backdoor into the system.
* A Hardcoded Credentials vulnerability in SAP Data Transfer Workbench
(CVSS Base Score:2.1).Updateis available in SAP Security Note2057982
<https://service.sap.com/sap/support/notes/2057982>. An attacker can
use the hardcoded credentials for unauthorized access and perform
various actions in the system. In addition, it is likely that the
code will be implemented as a backdoor into the system.
*The most critical issues found by other researchers*
Some of our readers and clients asked us to categorize the most critical
SAP vulnerabilities to patch them first. Companies providing SAP
Security Audit, SAP Security Assessment, or SAP Penetration Testing
services can include these vulnerabilities in their checklists. The most
critical vulnerabilities of this update can be patched by the following
SAP Security Notes:
* 2151237 <https://service.sap.com/sap/support/notes/2151237>: SAP GUI
for Windows has a Buffer Overflow vulnerability (CVSS Base
Score:9.3). An attacker can use Buffer Overflow for injecting
specially crafted code into working memory, which will be executed
by the vulnerable application under the privileges of that
application. This can lead to the attacker taking complete control
over the application, denial of service, command execution, and
other attacks. In case of command execution,attackercan obtain
critical technical and business-related information stored in the
vulnerable SAP-system or escalate their own privileges. As for
denial of service, the process of the vulnerable component may be
terminated. For this time, nobody will be able to use this service,
which negatively influences business processes, system downtime,
and, consequently, business reputation. It is recommended to install
this SAP Security Note to prevent risks.
* 2129609 <https://service.sap.com/sap/support/notes/2129609>: SAP EP
JDBC Connector has an SQL Injection vulnerability (CVSS Base
Score:6.5). An attacker can use SQL Injections with the help of
specially crafted SQL queries. They can read and modify sensitive
information from a database, execute administrative operations in a
database, destroy data or make it unavailable. In some cases, an
attacker can access system data or execute OS commands. It is
recommended to install this SAP Security Note to prevent risks.
* 1997734 <https://service.sap.com/sap/support/notes/1997734>: SAP RFC
runtime has a Missing AuthorizationXheckvulnerability (CVSS Base
Score:6.0). An attacker can use Missing Authorization Checks to
access a service without any authorization procedures and use
service functionality that has restricted access. This can lead to
information disclosure, privilege escalation, and other attacks. It
is recommended to install this SAP Security Note to prevent risks.
* 2163306 <https://service.sap.com/sap/support/notes/2163306>: SAP
CommonCryptoLib and SAPCRYPTOLIB are vulnerable to FREAK
(CVE-2015-0204, CVSS Base Score:5.0). It allows an attacker to
intercept HTTPS connections between vulnerable clients and servers
and force them to use weakened encryption, which the attacker can
break to steal or manipulate sensitive data. All the attacks on this
page assume a network adversary (i.e. a man-in-the-middle) to tamper
with TLS handshake messages. The typical scenario to mount such
attacks is by tampering with the Domain Name System (DNS), for
example via DNS rebinding or domain name seizure. This attack
targets a class of deliberately weak export cipher suites. It is
recommended to install this SAP Security Note to prevent risks.
*References about the FREAK vulnerability:*
* SMACK: State Machine AttaCKs <https://www.smacktls.com/>
* Tracking the FREAK Attack <https://freakattack.com/>
* CVE-2015-0204
<https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0204>
It is highly recommended to patch all those SAP vulnerabilities to
prevent business risks affecting your SAP systems.
SAP has traditionally thanked the security researchers from ERPScan for
found vulnerabilities on theiracknowledgment page
<http://scn.sap.com/docs/DOC-8218>.
Advisories for those SAP vulnerabilities with technical details will be
available in 3 months onerpscan.com <http://www.erpscan.com/>.
--
Darya Maenkova
PR manager
<https://www.linkedin.com/company/2217474?trk=ppro_cprof>
<https://twitter.com/erpscan>
<http://erpscan.com/>
------------------------------------------------------------------------
e-mail: d.maenkova@erpscan.com <mailto:d.maenkova@erpscan.com>
address: 228 Hamilton Avenue, Fl. 3, Palo Alto, CA. 94301
phone: 650.798.5255
erpscan.com <http://erpscan.com>