SAP J2EE Engine Telnet Unspecified Information Disclosure Vulnerability

Bugtraq ID:	40916
Class:	Unknown
CVE:	CVE-2010-2347
Remote:	Yes
Local:	No
Published:	Jun 16 2010 12:00AM
Updated:	Apr 13 2015 09:02PM
Credit:	Mariano Nuñez Di Croce
Vulnerable:	SAP J2EE Engine Core 7.30 SAP J2EE Engine Core 7.20 SAP J2EE Engine Core 7.11 SAP J2EE Engine Core 7.10 SAP J2EE Engine Core 7.02 SAP J2EE Engine Core 7.01 SAP J2EE Engine Core 7.00 SAP J2EE Engine Core 6.40
Not Vulnerable:

SAP J2EE Engine Telnet Unspecified Information Disclosure Vulnerability

The SAP J2EE engine is prone to a remote information-disclosure vulnerability.

Remote attackers can exploit this issue to obtain sensitive information. Information obtained may aim in further attacks and facilitate access to other services.

The issue affects the following:

SAP-JEECOR 6.40
SAP-JEECOR 7.00
SAP-JEECOR 7.01
SAP-JEECOR 7.02
SERVERCORE 7.10
SERVERCORE 7.11
SERVERCORE 7.20
SERVERCORE 7.30

SAP J2EE Engine Telnet Unspecified Information Disclosure Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

SAP J2EE Engine Telnet Unspecified Information Disclosure Vulnerability

Solution:
The vendor has released an advisory and updates to address this issue. Please see the references for more information.

SAP J2EE Engine Telnet Unspecified Information Disclosure Vulnerability

References:

• SAP J2EE Telnet Administration Security Check Bypass (Onapsis)
  
• SAP Note 1425847 (SAP)