CVE-2007-1915

Buffer overflow in the RFCSTARTPROGRAM function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended...

CVE-2007-1918

The CVE-2007-1918 issue affects SAP RFC Library 6.40 and 7.00 prior to 20070109, where the RFC_SET_REG_SERVER_PROPERTY function provides an option for exclusive access to an RFC server. This design allows remote attackers to cause a denial of service (client lockout) via unspecified vectors. The ...

CVE-2007-1915

CVE-2007-1915 concerns a buffer overflow in SAP RFC Library (versions 6.40 and 7.00 prior to 20061211) within the RFC_START_PROGRAM function. Reported as allowing remote attackers to execute arbitrary code via unspecified vectors. The description notes this information stems from a vague initial ...

CVE-2007-1916

CVE-2007-1916: SAP RFC Library (versions 6.40 and 7.00 prior to 20061211) contains a buffer overflow in the RFC_START_GUI function. This allows remote code execution via unspecified vectors; exact exploit details and affected inputs are not disclosed in the provided documents. The issue is docume...

CVE-2007-1913

The TRUSTEDSYSTEMSECURITY function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to verify the existence of users and groups on systems and domains via unspecified vectors, a different vulnerability than CVE-2006-6010. NOTE: This information is based upon a vague...

CVE-2007-1914

SAP RFC Library 6.40 and 7.00 prior to 20061211 contains a vulnerability in the RFC_START_PROGRAM function that allows remote attackers to obtain sensitive information (external RFC server configuration data) via unspecified vectors. This is a separate issue from CVE-2006-6010. Affected versions ...

CVE-2007-1917

The CVE-2007-1917 entry concerns the SAP RFC Library (versions 6.40 and 7.00 prior to 20061211). The documented vulnerability is a buffer overflow in the SYSTEM_CREATE_INSTANCE function, which could allow remote attackers to execute arbitrary code via unspecified vectors. In the provided connecte...

CVE-2007-1913

The CVE-2007-1913 entry pertains to SAP RFC Library 6.40 and 7.00 before 20061211. It describes an information-disclosure vulnerability in the TRUSTED_SYSTEM_SECURITY function that could allow remote attackers to verify the existence of users and groups on systems and domains via unspecified vect...

CVE-2007-1916

Buffer overflow in the RFCSTARTGUI function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended...

CVE-2007-1914

The RFCSTARTPROGRAM function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to obtain sensitive information external RFC server configuration data via unspecified vectors, a different vulnerability than CVE-2006-6010. NOTE: This information is based upon a vague...

CVE-2007-1918

The RFCSETREGSERVERPROPERTY function in the SAP RFC Library 6.40 and 7.00 before 20070109 implements an option for exclusive access to an RFC server, which allows remote attackers to cause a denial of service client lockout via unspecified vectors. NOTE: This information is based upon a vague...

CVE-2007-1915

Buffer overflow in the RFCSTARTPROGRAM function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended...

FreeBSD : fetchmail -- insecure APOP authentication (f1c4d133-e6d3-11db-99ea-0060084a00e5)

Matthias Andree reports : The POP3 standard, currently RFC-1939, has specified an optional, MD5-based authentication scheme called 'APOP' which no longer should be considered secure. Additionally, fetchmail's POP3 client implementation has been validating the APOP challenge too lightly and accept...

CVE-2007-1913: Undefined Security Weakness

The TRUSTEDSYSTEMSECURITY function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to verify the existence of users and groups on systems and domains via unspecified vectors, a different vulnerability than CVE-2006-6010. NOTE: This information is based upon a vague...

CVE-2007-1914: Undefined Security Weakness

The RFCSTARTPROGRAM function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to obtain sensitive information external RFC server configuration data via unspecified vectors, a different vulnerability than CVE-2006-6010. NOTE: This information is based upon a vague...

CVE-2007-1918: Undefined Security Weakness

The RFCSETREGSERVERPROPERTY function in the SAP RFC Library 6.40 and 7.00 before 20070109 implements an option for exclusive access to an RFC server, which allows remote attackers to cause a denial of service client lockout via unspecified vectors. NOTE: This information is based upon a vague...

CVE-2007-1917: Undefined Security Weakness

Buffer overflow in the SYSTEMCREATEINSTANCE function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has...

CVE-2007-1915: Undefined Security Weakness

Buffer overflow in the RFCSTARTPROGRAM function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended...

CVE-2007-1916: Undefined Security Weakness

Buffer overflow in the RFCSTARTGUI function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended...

CYBSEC Pre-Advisory: SAP TRUSTED_SYSTEM_SECURITY RFC Function Information Disclosure

The following pre-advisory is also available in PDF format for download at: http://www.cybsec.com/vuln/CYBSEC-SecurityAdvisorySAPTRUSTEDSYSTEMSECURITYRFCFunctionInformationDisclosure.pdf CYBSEC S.A. www.cybsec.com Pre-Advisory Name: SAP TRUSTEDSYSTEMSECURITY RFC Function Information Disclosure...