SAP R/3 sapinfo RFC API Account Locking Weakness
BID:7007
Info
SAP R/3 sapinfo RFC API Account Locking Weakness
| Bugtraq ID: | 7007 |
| Class: | Design Error |
| CVE: |
CVE-2003-1035 |
| Remote: | Yes |
| Local: | No |
| Published: | Mar 04 2003 12:00AM |
| Updated: | Jul 11 2009 08:06PM |
| Credit: | Discovery of this issue credited to Nicolas Gregoire. |
| Vulnerable: |
SAP SAPgui 4.6 D for Windows SAP SAPgui 4.6 C for Windows SAP SAP R/3 0 |
| Not Vulnerable: | |
Discussion
SAP R/3 sapinfo RFC API Account Locking Weakness
SAP R/3 may not lock a user account after numerous attempts to login fail. On a default installation, SAP R/3 is designed to lock out accounts that fail to properly authenticate after a set number of times.
An attacker can use the sapinfo utility to attempt to verify a password for a victim user. Due to the use of the sapinfo utility, SAP does not lock out the user account. This may provide the attacker with a greater chance of success for determining the victim user's password.
SAP R/3 may not lock a user account after numerous attempts to login fail. On a default installation, SAP R/3 is designed to lock out accounts that fail to properly authenticate after a set number of times.
An attacker can use the sapinfo utility to attempt to verify a password for a victim user. Due to the use of the sapinfo utility, SAP does not lock out the user account. This may provide the attacker with a greater chance of success for determining the victim user's password.
Exploit / POC
SAP R/3 sapinfo RFC API Account Locking Weakness
There is no exploit required.
There is no exploit required.
Solution / Fix
SAP R/3 sapinfo RFC API Account Locking Weakness
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
SAP R/3 sapinfo RFC API Account Locking Weakness
References:
References:
- SAP Homepage (SAP)
- SAP R/3, account locking and RFC SDK (Nicolas Gregoire [email protected])