SAP Kernel 'sapstartsrv' SOAP Server Information Disclosure Vulnerability

Bugtraq ID:	45780
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Jan 12 2011 12:00AM
Updated:	Jan 12 2011 12:00AM
Credit:	Onapsis Security
Vulnerable:	SAP KERNEL RELEASE 7.20 SAP KERNEL RELEASE 7.11 SAP KERNEL RELEASE 7.10 SAP KERNEL RELEASE 7.01 SAP KERNEL RELEASE 7.00 SAP KERNEL RELEASE 6.40
Not Vulnerable:

SAP Kernel 'sapstartsrv' SOAP Server Information Disclosure Vulnerability

SAP Kernel is prone to a remote information-disclosure vulnerability.

Remote attackers can exploit this issue to obtain sensitive information. Information obtained may aid in further attacks and facilitate access to other services.

The issue affects the following:

SAP Kernel 6.40 7.00, 7.01, 7.10, 7.11, 7.20.

SAP Kernel 'sapstartsrv' SOAP Server Information Disclosure Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

SAP Kernel 'sapstartsrv' SOAP Server Information Disclosure Vulnerability

Solution:
The vendor has released an advisory and updates to address this issue. Please see SAP note 1439348 for details.

SAP Kernel 'sapstartsrv' SOAP Server Information Disclosure Vulnerability

References:

• SAP Homepage (SAP)
  
• SAP Note 1439348 (SAP )