SAP Management Console Information Disclosure and Denial of Service Vulnerabilities

Bugtraq ID:	45690
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Jan 06 2011 12:00AM
Updated:	Jan 06 2011 12:00AM
Credit:	Jordan Santarsieri, Onapsis
Vulnerable:	SAP KERNEL RELEASE 7.20 SAP KERNEL RELEASE 7.11 SAP KERNEL RELEASE 7.10 SAP KERNEL RELEASE 7.01 SAP KERNEL RELEASE 7.00 SAP KERNEL RELEASE 6.40
Not Vulnerable:

SAP Management Console Information Disclosure and Denial of Service Vulnerabilities

SAP Management Console is prone to an information-disclosure vulnerability and a denial-of-service vulnerability.

Attackers can exploit these issues to a cause a denial-of-service condition or obtain sensitive information.

The following versions are vulnerable:

SAP KERNEL RELEASE 6.40
SAP KERNEL RELEASE 7.00
SAP KERNEL RELEASE 7.01
SAP KERNEL RELEASE 7.10
SAP KERNEL RELEASE 7.11
SAP KERNEL RELEASE 7.20

SAP Management Console Information Disclosure and Denial of Service Vulnerabilities

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

SAP Management Console Information Disclosure and Denial of Service Vulnerabilities

Solution:
Vendor updates are available. Please see the references for more information.

SAP Management Console Information Disclosure and Denial of Service Vulnerabilities

References:

• ONAPSIS-2011-001: SAP Management Console Unauthenticated Service Restart (Onapsis)
  
• ONAPSIS-2011-002: SAP Management Console Information Disclosure (Onapsis)
  
• SAP Note 1439348 (SAP)