PT-2017-14526 · Sap · Sap Plant Connectivity

Published 2017-12-12 · Updated 2017-12-29 · CVE-2017-16690

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Plant Connectivity versions 2.3 and 15.0

Description A malicious DLL preload attack is possible due to the way system DLLs are loaded by the NwSapSetup and Installation self-extracting program. Specifically, the program loads system DLLs like DWMAPI.dll from the folder the executable is in, rather than from the system location. This allows an attacker to load a malicious DLL with the same name as a system DLL, potentially executing arbitrary code.

Recommendations For SAP Plant Connectivity version 2.3, ensure that system DLLs are only loaded from the system folders to prevent malicious DLL preload attacks. For SAP Plant Connectivity version 15.0, consider restricting access to the NwSapSetup.exe executable until a fix is available, and ensure that system DLLs are only loaded from the system folders.

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2017-16690

Affected Products

Sap Plant Connectivity

References · 5

• https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-16690 · Security Note
• https://osv.dev/vulnerability/CVE-2017-16690 · Vendor Advisory
• https://launchpad.support.sap.com/#/notes/2529480 · Note
• http://securityfocus.com/bid/102145 · Note