PT-2005-5476 · Sap · Sap

Published 2005-12-31 · Updated 2018-10-19 · CVE-2005-4815

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SAP versions prior to 6.40 patch 4 SAP versions prior to 6.20 patch 1364 SAP versions prior to 4.6D patch 1767 SAP versions prior to 45B patch 913 SAP versions prior to 40B patch 1008 SAP versions prior to 31I patch 735

Description The issue allows remote attackers to execute arbitrary code via a certain UDP packet that ends with the name of a local executable file. This is due to improper restriction of process execution by lnaxdm/sapsys.

Recommendations For SAP versions prior to 6.40 patch 4, apply patch 4 to resolve the issue. For SAP versions prior to 6.20 patch 1364, apply patch 1364 to resolve the issue. For SAP versions prior to 4.6D patch 1767, apply patch 1767 to resolve the issue. For SAP versions prior to 45B patch 913, apply patch 913 to resolve the issue. For SAP versions prior to 40B patch 1008, apply patch 1008 to resolve the issue. For SAP versions prior to 31I patch 735, apply patch 735 to resolve the issue.

Fix

Related Identifiers

CVE-2005-4815

Affected Products

Sap

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2005-4815 · Security Note
• http://lists.virus.org/darklab-0509/msg00018.html · Note
• http://securityfocus.com/archive/1/451378/100/0/threaded · Note
• http://lists.virus.org/darklab-0509/msg00017.html · Note
• http://lists.darklab.org/pipermail/darklab/2006-January/000209.html · Note
• http://lists.virus.org/darklab-0509/msg00011.html · Note