PT-2016-1705 · Sap · Sap Netweaver As Java

Publicado 2016-04-14 · Atualizado 2018-12-10 · CVE-2016-4015

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SAP NetWeaver JAVA AS versions 7.1 through 7.4

Description The issue is related to errors in the code of the Enqueue Server component in SAP NetWeaver. It allows remote attackers to cause a denial of service, specifically a process crash, via a crafted request.

Recommendations For SAP NetWeaver JAVA AS versions 7.1 through 7.4, consider applying the fix as described in SAP Security Note 2258784 to resolve the issue. As a temporary workaround, consider restricting access to the Enqueue Server component to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-17

Identificadores relacionados

BDU:2016-01031

CVE-2016-4015

Produtos afetados

Sap Netweaver As Java

Referências · 7

• https://erpscan.io/advisories/erpscan-16-019-sap-netweaver-enqueue-server-dos-vulnerability · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-4015 · Nota de Segurança
• https://erpscan.com/advisories/erpscan-16-019-sap-netweaver-enqueue-server-dos-vulnerability · Nota
• https://bdu.fstec.ru/vul/2016-01031 · Nota de Segurança
• https://erpscan.io/press-center/blog/dos-vulnerabilities-on-the-rise-sap-security-notes-april-2016 · Nota
• https://erpscan.com/press-center/blog/dos-vulnerabilities-on-the-rise-sap-security-notes-april-2016 · Nota
• https://osv.dev/vulnerability/CVE-2016-4015 · Aviso do Fabricante