PT-2016-7329 · Sap · Sap Netweaver

Pablo Artuso · Publicado 2016-10-05 · Atualizado 2016-11-28 · CVE-2016-7435

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Netweaver version 7.40 SP 12

Description The issue allows remote authenticated users with certain permissions to execute arbitrary commands. This is achieved through vectors involving a CALL 'SYSTEM' statement in the SCTC subpackage, specifically in the (1) SCTC REFRESH EXPORT TAB COMP, (2) SCTC REFRESH CHECK ENV, and (3) SCTC TMS MAINTAIN ALOG functions.

Recommendations For SAP Netweaver version 7.40 SP 12, consider restricting access to the SCTC subpackage functions, specifically SCTC REFRESH EXPORT TAB COMP, SCTC REFRESH CHECK ENV, and SCTC TMS MAINTAIN ALOG, to minimize the risk of exploitation. As a temporary workaround, consider disabling the CALL 'SYSTEM' statement in these functions until a patch is available.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2016-7435

Produtos afetados

Sap Netweaver

Referências · 10

• https://onapsis.com/research/security-advisories/sap-os-command-injection-sctcrefreshcheckenv · Nota
• http://seclists.org/fulldisclosure/2016/Oct/1 · Nota
• http://securityfocus.com/bid/93272 · Nota
• https://onapsis.com/blog/analyzing-sap-security-notes-march-2016 · Nota
• http://seclists.org/fulldisclosure/2016/Oct/2 · Nota
• https://onapsis.com/research/security-advisories/sap-os-command-injection-sctcrefreshexporttabcomp · Nota
• https://onapsis.com/research/security-advisories/sap-os-command-injection-sctctmsmaintainalog · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-7435 · Nota de Segurança
• http://seclists.org/fulldisclosure/2016/Oct/0 · Nota
• https://osv.dev/vulnerability/CVE-2016-7435 · Aviso do Fabricante