SAP NetWeaver XRFC SOAP Request Stack Buffer Overflow Vulnerability
BID:44912
Info
SAP NetWeaver XRFC SOAP Request Stack Buffer Overflow Vulnerability
| Bugtraq ID: | 44912 |
| Class: | Boundary Condition Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 09 2010 12:00AM |
| Updated: | Nov 09 2010 12:00AM |
| Credit: | Alexey Sintsov of Digital Security Research Group |
| Vulnerable: |
SAP Netweaver XRFC 7.00 SAP Netweaver XRFC 6.40 |
| Not Vulnerable: | |
Discussion
SAP NetWeaver XRFC SOAP Request Stack Buffer Overflow Vulnerability
SAP NetWeaver XRFC is prone to a stack-based buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data.
An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.
SAP NetWeaver XRFC 6.4 and 7.0 are vulnerable; other versions may also be affected.
SAP NetWeaver XRFC is prone to a stack-based buffer-overflow vulnerability because it fails to properly bounds-check user-supplied data.
An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.
SAP NetWeaver XRFC 6.4 and 7.0 are vulnerable; other versions may also be affected.
Exploit / POC
SAP NetWeaver XRFC SOAP Request Stack Buffer Overflow Vulnerability
The reporter indicates that commercial exploit code is available.
The reporter indicates that commercial exploit code is available.
References
SAP NetWeaver XRFC SOAP Request Stack Buffer Overflow Vulnerability
References:
References:
- [DSECRG-10-005] SAP Netweaver XRFC - Stack Overflow (Digital Research Security Group)
- SAP NetWeaver Homepage (SAP)