SAP AG SAPgui KWEdit ActiveX Control Insecure Method Remote Code Execution Vulnerability
BID:34524
Info
SAP AG SAPgui KWEdit ActiveX Control Insecure Method Remote Code Execution Vulnerability
| Bugtraq ID: | 34524 |
| Class: | Design Error |
| CVE: |
CVE-2008-4830 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 15 2009 12:00AM |
| Updated: | Dec 03 2010 01:55PM |
| Credit: | Carsten Eiram |
| Vulnerable: |
SAP AG SAPgui 7.10 Patch Level 5 SAP AG SAPgui 6.40 Patch Level 29 |
| Not Vulnerable: | |
Discussion
SAP AG SAPgui KWEdit ActiveX Control Insecure Method Remote Code Execution Vulnerability
SAP AG SAPgui KWEdit ActiveX control is prone to a remote code-execution vulnerability.
Successfully exploiting this issue allows an attacker to execute arbitrary code in the context of the application running the affected control (typically Internet Explorer).
This issue affects the following:
SAPgui 6.40 Patch Level 29 with KWEDIT.DLL 6400.1.1.41
SAPgui 7.10 Patch Level 5 with KWEDIT.DLL 7100.1.1.43
Other versions may be vulnerable as well.
SAP AG SAPgui KWEdit ActiveX control is prone to a remote code-execution vulnerability.
Successfully exploiting this issue allows an attacker to execute arbitrary code in the context of the application running the affected control (typically Internet Explorer).
This issue affects the following:
SAPgui 6.40 Patch Level 29 with KWEDIT.DLL 6400.1.1.41
SAPgui 7.10 Patch Level 5 with KWEDIT.DLL 7100.1.1.43
Other versions may be vulnerable as well.
Exploit / POC
SAP AG SAPgui KWEdit ActiveX Control Insecure Method Remote Code Execution Vulnerability
To exploit this issue, attackers must trick a victim into viewing a malicious webpage.
A commercial proof of concept is available through VUPEN Security - Exploit and PoCs Service. This proof of concept is not otherwise publicly available or known to be circulating in the wild.
A Metasploit exploit module is available:
To exploit this issue, attackers must trick a victim into viewing a malicious webpage.
A commercial proof of concept is available through VUPEN Security - Exploit and PoCs Service. This proof of concept is not otherwise publicly available or known to be circulating in the wild.
A Metasploit exploit module is available:
Solution / Fix
SAP AG SAPgui KWEdit ActiveX Control Insecure Method Remote Code Execution Vulnerability
Solution:
The vendor has released an advisory that recommends setting the kill bit on the affected control. Please see the referenced advisory for more information.
Solution:
The vendor has released an advisory that recommends setting the kill bit on the affected control. Please see the referenced advisory for more information.
References
SAP AG SAPgui KWEdit ActiveX Control Insecure Method Remote Code Execution Vulnerability
References:
References:
- Microsoft Knowledge Base Article 240797 (Microsoft)
- SAP GUI KWEdit ActiveX Control 'SaveDocumentAs()' Insecure Method (Secunia)
- SAP Homepage (SAP)
- Secunia Research: SAP GUI KWEdit ActiveX Control 'SaveDocumentAs()' Insecure Met (Secunia Research
- SAP Note 1294913 (SAP)