PT-2015-6234 · Sap+1 · Sap Afaria+1

Russ Spooner · Published 2015-07-16 · Updated 2016-12-06 · CVE-2015-3449

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SAP Afaria version 7.0.6398.0

Description The issue concerns weak permissions set for the install folder of the Windows client in SAP Afaria, allowing local users to escalate privileges. This can be achieved by exploiting the weak permissions (Everyone: read and Everyone: write) through a Trojan horse XeService.exe file.

Recommendations For SAP Afaria version 7.0.6398.0, consider restricting access to the install folder to prevent local users from exploiting the weak permissions until a fix is available. As a temporary workaround, restrict write access to the XeService.exe file to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-254

Related Identifiers

CVE-2015-3449

Affected Products

Sap Afaria

Windows

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2015-3449 · Security Note
• http://securityfocus.com/bid/75725 · Note
• https://portcullis-security.com/security-research-and-downloads/security-advisories/cve-2015-3449 · Note
• http://seclists.org/fulldisclosure/2015/Jul/60 · Note
• http://packetstormsecurity.com/files/132681/SAP-Afaria-XeService.exe-7.0.6398.0-Weak-File-Permissions.html · Note