PT-2015-2653 · Sap · Sap Hana Db

Nahuel D. Sánchez · Published 2015-11-10 · Updated 2015-11-12 · CVE-2015-7993

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SAP HANA DB version 1.00.73.00.389160

Description The issue exists due to insufficient input validation in the Extended Application Services component of the SAP HANA database management system. This allows a remote attacker to execute arbitrary code during the HTTP server authentication procedure.

Recommendations For SAP HANA DB version 1.00.73.00.389160, consider applying the fix provided in SAP Security Note 2197397 to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2015-12018

CVE-2015-7993

Affected Products

Sap Hana Db

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2015-7993 · Security Note
• https://bdu.fstec.ru/vul/2015-12018 · Security Note
• http://packetstormsecurity.com/files/134286/SAP-HANA-HTTP-Login-Remote-Code-Execution.html · Note
• https://onapsis.com/blog/analyzing-sap-security-notes-september-2015 · Note
• http://seclists.org/fulldisclosure/2015/Nov/39 · Note
• https://onapsis.com/research/security-advisories/SAP_HANA_Remote_Code_Execution_HTTP_based · Note