PT-2016-1129 · Sap · Sap Hana

Mathieu Geli · Published 2016-01-20 · Updated 2018-12-10 · CVE-2016-1929

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:C

Name of the Vulnerable Software and Affected Versions SAP HANA (affected versions not specified)

Description The issue allows remote attackers to spoof log entries in trace files, potentially causing a denial of service due to disk consumption and process crash. This is achieved via a crafted HTTP request, related to an unspecified debug function. The problem exists due to insufficient input validation in the XS engine of the SAP HANA database management system. An attacker can exploit this issue to cause a denial of service using a specially formed HTTP request.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2016-00388

CVE-2016-1929

Affected Products

Sap Hana

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2016-1929 · Security Note
• https://bdu.fstec.ru/vul/2016-00388 · Security Note
• https://erpscan.io/advisories/erpscan-16-002-sap-hana-log-injection-and-no-size-restriction · Note
• https://erpscan.io/press-center/blog/sap-security-notes-january-2016-review · Note
• http://erpscan.com/advisories/erpscan-16-002-sap-hana-log-injection-and-no-size-restriction · Note
• http://seclists.org/fulldisclosure/2016/Apr/59 · Note
• http://erpscan.com/press-center/blog/sap-security-notes-january-2016-review · Note