SAP Security Notes June 2013

Welcome to our first SAP Security Advisory Post. Depending on feedback, we will outline all SAP Security notes issued by SAP each following month and make these available to you. As you know, each SAP Security with vulnerabilities is generally rated with a Common Vulnerability Scoring System (CVSS V 2.0) code. The Common Vulnerability Scoring System (CVSS) provides an open framework for communicating the characteristics and impacts of IT vulnerabilities. SAP is adopting CVSS version 2.0.

The Common Vulnerability Scoring System (CVSS) provides an open framework for communicating the characteristics and impacts of IT vulnerabilities. CVSS consists of 3 groups: Base, Temporal and Environmental. Each group produces a numeric score ranging from 0 to 10, and a Vector, a compressed textual representation that reflects the values used to derive the score. The Base group represents the intrinsic qualities of a vulnerability. The Temporal group reflects the characteristics of a vulnerability that change over time. The Environmental group represents the characteristics of a vulnerability that are unique to any user’s environment. CVSS enables IT managers, vulnerability bulletin providers, security vendors, application vendors and researchers to all benefit by adopting this common language of scoring IT vulnerabilities.

We will issue tips & tricks and additional Vulnerability issues in future Newsletters as well as what your organization can do to be prepared and informed about potential risks to your SAP infrastructure. Below the outline of all SAP Security notes issued in June 2013:In June 2013, SAP released 33 security related OSS notes. Below the statistics:

• 8 Notes are not rated with a CVSS score
• 11 Notes are rated with a CVSS score between 3.5 to 5.0
• 15 Notes are rated with a CVSS score of 6 and above

The SAP note with the highest score is 1851914 Potential remote code execution in EAServer: This Note addresses the issue where an attacker can exploit EAServer to enable them to remote code execution, including viewing, changing, or deleting data. We advise you, if this note is of interest to you, to review the following 2 notes as well as these are also related to EAServer:

We recommend that companies review the high priority notes published on the SAP Service marketplace and apply these without delays after validating the impact to your business operations.

Below a few other notes that are worth to review as these are interesting and SAP puts a High Priority to have these notes applied to your system:

The program code contains a possibility to define and execute user-defined code that changes the behavior of the system. A valid and authenticated user is required. Depending on the code, the user can: inject and run their own code, obtain additional information that should not be displayed, modify data, delete data, modify the output of the system, create new users with higher privileges, perform a denial of service attack.

The functions of the SAP profile do not contain authorization checks for checking an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.

An end user can assign himself any business role or potentially also any privilege without that an approval is done. A valid and authenticated user is required.

The vulnerability is caused by a hard-coded profile in the program’s source code. An attacker who specifies these credentials can log on to the system without having been assigned legitimate access by the system administrator(s). If a user already has privileges with which they can log on, an escalation of privileges may be possible if the hard-coded account has higher access rights than the original user.

The SAP NetWeaver Identity Management 7.2 REST interface with version identifier “v72alpha” executes certain functions by referencing specific URLs.

When an attacker tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user. This applies to all modification operations provided by the REST interface.

The attacker may use a cross-site scripting attack to do this, or they may present a link to the victim.

Please leave your comments and/or discuss this post with others. Your expertise is highly appreciated!