PT-2015-5693 · Sap+1 · Gui+7

Martin Gallo · Publicado 2015-06-02 · Atualizado 2018-10-09 · CVE-2015-2278

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions SAP MaxDB versions 7.5 through 7.6 Netweaver Application Server ABAP (affected versions not specified) Netweaver Application Server Java (affected versions not specified) Netweaver RFC SDK (affected versions not specified) GUI (affected versions not specified) RFC SDK (affected versions not specified) SAPCAR archive tool (affected versions not specified)

Description The issue allows context-dependent attackers to cause a denial of service via unspecified vectors, related to look-ups of non-simple codes in the LZH decompression implementation, specifically in the CsObjectInt::BuildHufTree function.

Recommendations For SAP MaxDB versions 7.5 through 7.6, update to a version that includes the fix for the CsObjectInt::BuildHufTree function issue. For Netweaver Application Server ABAP, apply the necessary patches or updates as specified in the relevant security notes. For Netweaver Application Server Java, apply the necessary patches or updates as specified in the relevant security notes. For Netweaver RFC SDK, apply the necessary patches or updates as specified in the relevant security notes. For GUI, apply the necessary patches or updates as specified in the relevant security notes. For RFC SDK, apply the necessary patches or updates as specified in the relevant security notes. For SAPCAR archive tool, apply the necessary patches or updates as specified in the relevant security notes. As a temporary workaround, consider restricting the use of the LZH decompression implementation until a patch is available.

Exploit

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2015-2278

SUSE-SU-2016:0805-1

SUSE-SU-2016:0807-1

SUSE-SU-2016_0805-1

SUSE-SU-2016_0807-1

Produtos afetados

Gui

Sap Netweaver Application Server Abap

Sap Netweaver Application Server Java

Netweaver Rfc Sdk

Rfc Sdk

Sap Maxdb

Sapcar Archive Tool

Suse

Referências · 19

• 🔥 http://seclists.org/fulldisclosure/2015/May/96 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2015/May/50 · Exploit
• 🔥 http://coresecurity.com/advisories/sap-lzc-lzh-compression-multiple-vulnerabilities · Exploit
• 🔥 http://packetstormsecurity.com/files/131883/SAP-LZC-LZH-Compression-Denial-Of-Service.html · Exploit
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-2278 · Nota de Segurança
• https://lists.suse.com/pipermail/sle-security-updates/2016-March/001953.html · Nota
• http://securityfocus.com/bid/74643 · Nota
• https://suse.com/security/cve/CVE-2015-2278 · Nota
• https://suse.com/security/cve/CVE-2015-2282.html · Nota
• https://lists.suse.com/pipermail/sle-security-updates/2016-March/001951.html · Nota
• https://suse.com/support/update/announcement/2016/suse-su-20160807-1 · Nota
• https://suse.com/security/cve/CVE-2015-2278.html · Nota
• https://osv.dev/vulnerability/SUSE-SU-2016:0807-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2015-2282 · Nota