SAP DB Web Server buffer overflow vulnerability

Overview

The SAP Web Server contains a vulnerability that may allow an attacker to execute arbitrary code or cause a denial-of-service condition.

Description

SAP DB is a database server that includes a series of web-based configuration tools.

A stack based buffer overlfow exists in the SAP DB web server (WAHTTP.exe). Note that this vulnerability only affects the web server that is included with the SAP DB server. Systems hosting the SAP web tools on a different web server are not affected by this vulnerability.

---

Impact

An attacker may be able to execute arbitrary code, or create a denial-of-service condition.

---

Solution

Upgrade

According to public reports, this vulnerability is addressed in the latest version of the SAP Message Server. SAP users should contact SAP for more information.

Until a fixed version of the SAP Web Server can be deployed, the following workaround may reduce the chances of exploitation:

---

Restrict access

Restricting access to 9999/tcp by using access control lists or firewall rules may prevent a remote attacker from exploiting this vulnerability.

---

Vendor Information

679041

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Javascript is disabled. Click here to view vendors.

SAP Affected

Updated: July 10, 2007

Status

Affected

Vendor Statement

We have not received a statement from the vendor.

Vendor Information

The vendor has not provided us with any further information regarding this vulnerability.

CVSS Metrics

Group	Score	Vector
Base
Temporal
Environmental

References

• <http://www.ngssoftware.com/advisories/critical-risk-vulnerability-in-sap-db-web-server-stack-overflow/&gt;
• <http://www.securityfocus.com/bid/24773&gt;
• <http://www.frsirt.com/english/advisories/2007/2453&gt;
• <http://www.securitytracker.com/id?1018341&gt;
• <http://secunia.com/advisories/25954&gt;
• <http://xforce.iss.net/xforce/xfdb/35277&gt;

Acknowledgements

Thanks to Mark Litchfield of NGS software for information that was used in this report.

This document was written by Ryan Giobbi.

Other Information

CVE IDs:	CVE-2007-3614
Severity Metric:	2.98 Date Public: