PT-2015-2653 · Sap · Sap Hana Db

Nahuel D. Sánchez · Publicado 2015-11-10 · Atualizado 2015-11-12 · CVE-2015-7993

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SAP HANA DB version 1.00.73.00.389160

Description The issue exists due to insufficient input validation in the Extended Application Services component of the SAP HANA database management system. This allows a remote attacker to execute arbitrary code during the HTTP server authentication procedure.

Recommendations For SAP HANA DB version 1.00.73.00.389160, consider applying the fix provided in SAP Security Note 2197397 to resolve the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2015-12018

CVE-2015-7993

Produtos afetados

Sap Hana Db

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2015-7993 · Nota de Segurança
• http://packetstormsecurity.com/files/134286/SAP-HANA-HTTP-Login-Remote-Code-Execution.html · Nota
• https://bdu.fstec.ru/vul/2015-12018 · Nota de Segurança
• https://onapsis.com/blog/analyzing-sap-security-notes-september-2015 · Nota
• http://seclists.org/fulldisclosure/2015/Nov/39 · Nota
• https://onapsis.com/research/security-advisories/SAP_HANA_Remote_Code_Execution_HTTP_based · Nota