PT-2021-17557 · Sap · Sap Internet Graphics Server

Published 2021-06-09 · Updated 2022-10-31 · CVE-2021-27622

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions SAP Internet Graphics Service versions 7.20, 7.20EXT, 7.53, 7.20 EX2, 7.81

Description The issue allows an unauthenticated attacker to submit a malicious request over a network after retrieving an existing system state value. This is due to insufficient input validation in the CDrawRaster::LoadImageFromMemory() method, which triggers an internal memory corruption error, causing the system to crash and become unavailable. No data in the system can be viewed or modified during this attack.

Recommendations For SAP Internet Graphics Service versions 7.20, 7.20EXT, 7.53, 7.20 EX2, 7.81, consider disabling the CDrawRaster::LoadImageFromMemory() method until a patch is available to prevent exploitation. Restrict access to the SAP Internet Graphics Service to minimize the risk of the system becoming unavailable due to the attack. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2021-27622

Affected Products

Sap Internet Graphics Server

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-27622 · Security Note
• https://launchpad.support.sap.com/#/notes/3021050 · Vendor Advisory
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=578125999 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-27622 · Vendor Advisory
• https://t.me/cvenotify/15975 · Telegram Post
• https://t.me/cvenotify/16307 · Telegram Post