PT-2004-1213 · Sap · Sap R/3

Publicado 2004-03-16 · Atualizado 2018-10-19 · CVE-2003-1035

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SAP R/3 version 46C/D

Description The issue allows remote attackers to bypass account locking by using the RFC API for brute force password guessing attacks, which does not lock out the account like the SAPGUI does.

Recommendations For SAP R/3 version 46C/D, consider restricting access to the RFC API to minimize the risk of exploitation. As a temporary workaround, implement additional account lockout measures outside of the SAPGUI to prevent brute force attacks.

Correção

Identificadores relacionados

CVE-2003-1035

Produtos afetados

Sap R/3

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2003-1035 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11487 · Nota
• http://lists.grok.org.uk/pipermail/full-disclosure/2003-March/004039.html · Nota
• http://securityfocus.com/bid/7007 · Aviso do Fabricante
• http://securityfocus.com/archive/1/451378/100/0/threaded · Nota