SAP AG SAPgui 'sapirrfc.dll' ActiveX Control Buffer Overflow Vulnerability

Bugtraq ID:	35256
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 08 2009 12:00AM
Updated:	Dec 14 2009 11:43PM
Credit:	Alexander Polyakov
Vulnerable:	SAP AG SAPgui 6.4
Not Vulnerable:

SAP AG SAPgui 'sapirrfc.dll' ActiveX Control Buffer Overflow Vulnerability

SAP AG SAPgui is prone to a remote buffer-overflow vulnerability.

Attackers can exploit this issue to execute arbitrary code within the context of an application that uses the ActiveX control (typically Internet Explorer). Failed exploit attempts will result in a denial-of-service condition.

SAPgui 6.4 is vulnerable; other versions may also be affected.

SAP AG SAPgui 'sapirrfc.dll' ActiveX Control Buffer Overflow Vulnerability

A working commercial exploit is available through VUPEN Security - Exploit and PoCs Service. This exploit is not otherwise publicly available or known to be circulating in the wild.

The following proof of concept and exploit are available:

• /data/vulnerabilities/exploits/35256.html
• /data/vulnerabilities/exploits/35256-2.html

SAP AG SAPgui 'sapirrfc.dll' ActiveX Control Buffer Overflow Vulnerability

Solution:
The vendor has released a new version. Please see the references for details.

SAP AG SAPgui 'sapirrfc.dll' ActiveX Control Buffer Overflow Vulnerability

References:

• Microsoft Knowledge Base Article 240797 (Microsoft)
  
• SAP Homepage (SAP)
  
• SAP Support Note 1286637 (SAP)
  
• [DSECRG-09-015] SAP GUI 6.4 Buffer Overflow vulnerability (Alexandr Polyakov )