Security advisories on Martin Gallo

SAP HANA SAML Improper Validation Vulnerabilities

Tue, 08 Dec 2020 00:00:00 +0000

1. Advisory Information

Title: SAP HANA SAML Improper Validation Vulnerabilities
Advisory ID: SAUTH-2020-0001
Advisory URL: https://www.secureauth.com/labs/advisories/sap-hana-saml-assertion-improper-validation-authentication
Date published: 2020-12-08
Date of last update: 2021-03-04
Vendors contacted: SAP
Release mode: Coordinated release

2. Vulnerability Information

Class: Improper Authentication [CWE-287], Improper Authentication [CWE-287], Security Misconfiguration [CWE-1032]
Impact: Security bypass
Remotely Exploitable: Yes
Locally Exploitable: Yes
CVE Name: CVE-2020-26834, CVE-2021-21474

3. Vulnerability Description

SAP HANA[1] is an in-memory database engine and application server developed by SAP[2]. The HANA database allows connections to the database using a proprietary protocol called HANA SQL Command Network Protocol[3], as well as through the standard HTTP protocol to XS and XS Advanced applications. Connections to the database are authenticated using different mechanisms, which include the integration with multiple Single Sign-On (SSO) environments through a variety of protocols[4].

SAP Note Assistant Insecure handling of SAP Notes signature vulnerability

Thu, 30 Nov 2017 00:00:00 +0000

Core Security - Corelabs Advisory http://corelabs.coresecurity.com/

SAP Note Assistant Insecure handling of SAP Notes signature vulnerability

1. Advisory Information

Title: SAP Note Assistant Insecure handling of SAP Notes signature vulnerability
Advisory ID: CORE-2017-0011
Advisory URL: http://www.coresecurity.com/advisories/SAP-Note-Assistant-Insecure-handling-of-SAP-Notes-signature-vulnerability
Date published: 2017-11-30
Date of last update: 2017-11-27
Vendors contacted: SAP
Release mode: Coordinated release

2. Vulnerability Information

Class: Improper Verification of Cryptographic Signature [CWE-347], Improper Limitation of a Pathname to a Restricted Directory [CWE-22]
Impact: Code execution
Remotely Exploitable: Yes
Locally Exploitable: Yes
CVE Name: CVE-2017-16691

3. Vulnerability Description

SAP distributes program fixes in so called SAP Notes. A component, called SAP Note Assistant [1] is available to assist on managing and installing SAP Notes on SAP Netweaver Application Server systems. In September 2017, a new functionality [2][3] was introduced in SAP Note Assistant that enabled the tool to validate the signature of SAP Notes archive files and thus increase the security of the SAP Notes installation process.

SAP SAPCAR Heap Based Buffer Overflow Vulnerability

Wed, 10 May 2017 00:00:00 +0000

1. Advisory Information

Title: SAP SAPCAR Heap Based Buffer Overflow Vulnerability
Advisory ID: CORE-2017-0001
Advisory URL: http://www.coresecurity.com/advisories/sap-sapcar-heap-based-buffer-overflow-vulnerability
Date published: 2017-05-10
Date of last update: 2017-05-10
Vendors contacted: SAP
Release mode: Coordinated release

2. Vulnerability Information

Class: Heap-based Buffer Overflow [CWE-122]
Impact: Code execution
Remotely Exploitable: No
Locally Exploitable: Yes
CVE Name: CVE-2017-8852

3. Vulnerability Description

SAP [1] distributes software and packages using an archive program called SAPCAR [2]. This program uses a custom archive file format. A memory corruption vulnerability was found in the parsing of specially crafted archive files, that could lead to local code execution scenarios.

SAP CAR Multiple Vulnerabilities

Tue, 09 Aug 2016 00:00:00 +0000

1. Advisory Information

Title: SAP CAR Multiple Vulnerabilities
Advisory ID: CORE-2016-0006
Advisory URL: http://www.coresecurity.com/advisories/sap-car-multiple-vulnerabilities
Date published: 2016-08-09
Date of last update: 2016-08-09
Vendors contacted: SAP
Release mode: Coordinated release

2. Vulnerability Information

Class: Unchecked Return Value [CWE-252], TOCTOU Race Condition [CWE-367]
Impact: Denial of service, Security bypass
Remotely Exploitable: No
Locally Exploitable: Yes
CVE Name: CVE-2016-5845, CVE-2016-5847

3. Vulnerability Description

SAP [1] distributes software and packages using an archive program called SAPCAR. This program uses a custom archive file format. Vulnerabilities were found in the extraction of specially crafted archive files, that could lead to local denial of service conditions or privilege escalation.

SAP Download Manager Password Weak Encryption

Tue, 08 Mar 2016 00:00:00 +0000

1. Advisory Information

Title: SAP Download Manager Password Weak Encryption
Advisory ID: CORE-2016-0004
Advisory URL: http://www.coresecurity.com/advisories/sap-download-manager-password-weak-encryption
Date published: 2016-03-08
Date of last update: 2016-03-07
Vendors contacted: SAP
Release mode: Coordinated release

2. Vulnerability Information

Class: Storing Passwords in a Recoverable Format [CWE-257]
Impact: Information leak
Remotely Exploitable: No
Locally Exploitable: Yes
CVE Name: CVE-2016-3684

3. Vulnerability Description

SAP Download Manager [1] is a Java application offered by SAP that allows downloading software packages and support notes. This program stores the user’s settings in a configuration file. Sensitive values, such as the proxy username and password if set, are stored encrypted using a fixed static key.

Sendio ESP Information Disclosure Vulnerability

Fri, 22 May 2015 00:00:00 +0000

1. Advisory Information

Title: Sendio ESP Information Disclosure Vulnerability
Advisory ID: CORE-2015-0010
Advisory URL: http://www.coresecurity.com/advisories/sendio-esp-information-disclosure-vulnerability
Date published: 2015-05-22
Date of last update: 2015-05-22
Vendors contacted: Sendio
Release mode: Coordinated release

2. Vulnerability Information

Class: OWASP Top Ten 2013 Category A2 - Broken Authentication and Session Management [CWE-930], Information Exposure [CWE-200]
Impact: Security bypass
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2014-0999, CVE-2014-8391

3. Vulnerability Description

Sendio [1] ESP (E-mail Security Platform) is a network appliance which provides anti-spam and anti-virus solutions for enterprises. Two information disclosure issues were found affecting some versions of this software, and can lead to leakage of sensitive information such as user’s session identifiers and/or user’s email messages.

SAP LZC/LZH Compression Multiple Vulnerabilities

Tue, 12 May 2015 00:00:00 +0000

1. Advisory Information

Title: SAP LZC/LZH Compression Multiple Vulnerabilities
Advisory ID: CORE-2015-0009
Advisory URL: http://www.coresecurity.com/advisories/sap-lzc-lzh-compression-multiple-vulnerabilities
Date published: 2015-05-12
Date of last update: 2015-05-12
Vendors contacted: SAP
Release mode: Coordinated release

2. Vulnerability Information

Class: Out-of-bounds Write [CWE-787], Out-of-bounds Read [CWE-125]
Impact: Denial of service
Remotely Exploitable: Yes
Locally Exploitable: Yes
CVE Name: CVE-2015-2282, CVE-2015-2278

3. Vulnerability Description

SAP products make use of a proprietary implementation of the Lempel-Ziv-Thomas (LZC) adaptive dictionary compression algorithm and the Lempel-Ziv-Huffman (LZH) compression algorithm [1] . These compression algorithms are used across several SAP products and programs. Vulnerabilities were found in the decompression routines that could be triggered in different scenarios, and could lead to execution of arbitrary code and denial of service conditions.

SAP Netweaver Enqueue Server Trace Pattern Denial of Service

Wed, 15 Oct 2014 00:00:00 +0000

1. Advisory Information

Title: SAP Netweaver Enqueue Server Trace Pattern Denial of Service Vulnerability
Advisory ID: CORE-2014-0007
Advisory URL: http://www.coresecurity.com/advisories/sap-netweaver-enqueue-server-trace-pattern-denial-service-vulnerability
Date published: 2014-10-15
Date of last update: 2014-10-15
Vendors contacted: SAP
Release mode: Coordinated release

2. Vulnerability Information

Class: Uncontrolled Recursion [CWE-674]
Impact: Denial of service
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2014-0995

3. Vulnerability Description

SAP Netweaver [1] is a technology platform for building and integrating SAP business applications. A vulnerability has been found in SAP Netweaver that could allow an unauthenticated, remote attacker to create denial of service conditions. The vulnerability is triggered by sending a specially crafted SAP Enqueue Server packet to remote TCP port 32NN (NN being the SAP system number) of a host running the “Standalone Enqueue Server” service, part of SAP Netweaver Application Server ABAP/Java. The “Standalone Enqueue Server” is a critical component of a SAP Netweaver installation in terms of availability, rendering the whole SAP system unresponsive.

SAP Router Password Timing Attack

Tue, 15 Apr 2014 00:00:00 +0000

1. Advisory Information

Title: SAP Router Password Timing Attack
Advisory ID: CORE-2014-0003
Advisory URL: http://www.coresecurity.com/advisories/sap-router-password-timing-attack
Date published: 2014-04-15
Date of last update: 2014-03-06
Vendors contacted: SAP
Release mode: Coordinated release

2. Vulnerability Information

Class: Information Exposure Through Timing Discrepancy [CWE-208]
Impact: Security bypass
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2014-0984

3. Vulnerability Description

SAP Router [1] is an application-level gateway used to connect systems in a SAP infrastructure. A vulnerability have been found in SAP Router that could allow an unauthenticated remote attacker to obtain passwords used to protect route entries by a timing side-channel attack.

SAP Netweaver Message Server Multiple Vulnerabilities

Wed, 13 Feb 2013 00:00:00 +0000

1. Advisory Information

Title: SAP Netweaver Message Server Multiple Vulnerabilities
Advisory ID: CORE-2012-1128
Advisory URL: http://www.coresecurity.com/content/SAP-netweaver-msg-srv-multiple-vulnerabilities
Date published: 2013-02-13
Date of last update: 2013-02-13
Vendors contacted: SAP
Release mode: Coordinated release

2. Vulnerability Information

Class: Improper Validation of Array Index [CWE-129], Buffer overflow [CWE-119]
Impact: Code execution, Denial of service
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2013-1592, CVE-2013-1593

3. Vulnerability Description

SAP Netweaver [1] is a technology platform for building and integrating SAP business applications. Multiple vulnerabilities have been found in SAP Netweaver that could allow an unauthenticated remote attacker to execute arbitrary code and lead to denial of service conditions. The vulnerabilities are triggered sending specially crafted SAP Message Server packets to remote TCP ports 36NN and/or 39NN (being NN the SAP system number) of a host running the ‘Message Server’ service, part of SAP Netweaver Application Server ABAP. By sending different messages, the different vulnerabilities can be triggered.

SAP Netweaver Dispatcher Multiple Vulnerabilities

Tue, 08 May 2012 00:00:00 +0000

1. Advisory Information

Title: SAP Netweaver Dispatcher Multiple Vulnerabilities
Advisory ID: CORE-2012-0123
Advisory URL: http://www.coresecurity.com/content/sap-netweaver-dispatcher-multiple-vulnerabilities
Date published: 2012-05-08
Date of last update: 2012-05-08
Vendors contacted: SAP
Release mode: Coordinated release

2. Vulnerability Information

Class: Buffer overflow [CWE-119]
Impact: Code execution, Denial of service
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2011-1516, CVE-2011-1517, CVE-2012-2511, CVE-2012-2512, CVE-2012-2513, CVE-2012-2514

3. Vulnerability Description

SAP Netweaver [1] is a technology platform for building and integrating SAP business applications. Multiple vulnerabilities have been found in SAP Netweaver that could allow an unauthenticated, remote attacker to execute arbitrary code and lead to denial of service conditions. The vulnerabilities are triggered sending specially crafted SAP Diag packets to remote TCP port 32NN (being NN the SAP system number) of a host running the “Dispatcher” service, part of SAP Netweaver Application Server ABAP. By sending different messages, the different vulnerabilities can be triggered.