PT-2016-5941 · Sap · Sapcryptolib

Fernando Russ + 2 · Published 2016-10-13 · Updated 2016-11-28 · CVE-2016-4407

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SAP SAPCRYPTOLIB version 5.555.38

Description The issue concerns the DSA algorithm implementation, which does not properly check signatures. This allows remote authenticated users to impersonate arbitrary users via unspecified vectors.

Recommendations For SAP SAPCRYPTOLIB version 5.555.38, update to a version that properly checks signatures to prevent impersonation.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2016-4407

Affected Products

Sapcryptolib

References · 5

• https://osv.dev/vulnerability/CVE-2016-4407 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4407 · Security Note
• https://onapsis.com/research/security-advisories/sap-missing-signature-check-dsa-algorithm · Note
• http://securityfocus.com/bid/93502 · Note
• http://seclists.org/fulldisclosure/2016/Oct/32 · Note