PT-2021-20262 · Sap · Sap Netweaver As Abap

Published 2021-07-14 · Updated 2023-07-01 · CVE-2021-33684

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS ABAP and ABAP Platform versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT SAP NetWeaver AS ABAP and ABAP Platform versions KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT SAP NetWeaver AS ABAP and ABAP Platform versions KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49 SAP NetWeaver AS ABAP and ABAP Platform versions KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 8.04 SAP NetWeaver AS ABAP and ABAP Platform versions KERNEL 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.77, 7.81, 7.84, 8.04

Description: The issue allows an attacker to send overlong content in the RFC request type, thereby crashing the corresponding work process because of a memory corruption issue. The work process will attempt to restart itself after the crash, and hence the impact on availability is low.

Recommendations: For SAP NetWeaver AS ABAP and ABAP Platform versions KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, consider restricting the length of content in RFC requests to prevent work process crashes. For SAP NetWeaver AS ABAP and ABAP Platform versions KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, consider restricting the length of content in RFC requests to prevent work process crashes. For SAP NetWeaver AS ABAP and ABAP Platform versions KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, consider restricting the length of content in RFC requests to prevent work process crashes. For SAP NetWeaver AS ABAP and ABAP Platform versions KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 8.04, consider restricting the length of content in RFC requests to prevent work process crashes. For SAP NetWeaver AS ABAP and ABAP Platform versions KERNEL 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.77, 7.81, 7.84, 8.04, consider restricting the length of content in RFC requests to prevent work process crashes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2021-33684

Affected Products

Sap Netweaver As Abap

References · 8

• https://osv.dev/vulnerability/CVE-2021-33684 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33684 · Security Note
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506 · Vendor Advisory
• https://t.me/cvenotify/17588 · Telegram Post
• https://t.me/cvenotify/17587 · Telegram Post
• https://t.me/cybersecuritytechnologies/8589 · Telegram Post
• https://t.me/true_secator/4564 · Telegram Post
• https://launchpad.support.sap.com/#/notes/3032624 · Note