SAP WebAS 'cachetest' Service Denial of Service Vulnerability

Bugtraq ID:	49645
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Sep 15 2011 12:00AM
Updated:	Sep 15 2011 12:00AM
Credit:	Mariano Nuez Di Croce
Vulnerable:	SAP Web Application Server 7.0
Not Vulnerable:

SAP WebAS 'cachetest' Service Denial of Service Vulnerability

SAP WebAS is prone to a denial-of-service vulnerability.

Attackers may leverage this issue to crash the affected application, denying service to legitimate users.

SAP Web Application Server 7.0.0 is vulnerable; other versions may also be affected.

SAP WebAS 'cachetest' Service Denial of Service Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

SAP WebAS 'cachetest' Service Denial of Service Vulnerability

Solution:
Updates are available. Please see the references for details.

SAP WebAS 'cachetest' Service Denial of Service Vulnerability

References:

• SAP Homepage (SAP)
  
• Onapsis Security Advisory 2011-014 SAP WebAS Remote Denial of Service (research)
  
• ONAPSIS-2011-014: SAP WebAS Remote Denial of Service (ONAPSIS)
  
• SAP Note 1553930: Patches (SAP)