PT-2020-7352 · Sap · Sap Netweaver

Francisco Falcon + 1 · Published 2020-01-23 · Updated 2020-01-31 · CVE-2013-1592

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver versions 2004s, 7.01 SR1, 7.02 SP06, and 7.30 SP04

Description: A Buffer Overflow issue exists in the Message Server service, specifically in the MsJ2EE AddStatistics() function, when it processes specially crafted SAP Message Server packets sent to remote TCP ports. This could allow a remote malicious user to execute arbitrary code.

Recommendations: For SAP NetWeaver version 2004s, update to a version that includes the fix for this issue. For SAP NetWeaver version 7.01 SR1, update to a version that includes the fix for this issue. For SAP NetWeaver version 7.02 SP06, update to a version that includes the fix for this issue. For SAP NetWeaver version 7.30 SP04, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the MsJ2EE AddStatistics() function in the Message Server service until a patch is available.

Exploit

Fix

RCE

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2013-1592

Affected Products

Sap Netweaver

References · 8

• 🔥 http://exploit-db.com/exploits/24511 · Exploit
• 🔥 http://coresecurity.com/content/SAP-netweaver-msg-srv-multiple-vulnerabilities · Exploit
• 🔥 https://exploit-db.com/exploits/24511 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-1592 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/82064 · Note
• http://securityfocus.com/bid/57956 · Note
• http://securitytracker.com/id/1028148 · Note
• https://packetstormsecurity.com/files/cve/CVE-2013-1592 · Note