SAP NetWeaver CVE-2014-8592 Multiple Denial of Service Vulnerabilities

Bugtraq ID:	71026
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2014-8592
Remote:	Yes
Local:	No
Published:	Oct 17 2014 12:00AM
Updated:	Oct 17 2014 12:00AM
Credit:	Igor Ilyin, and Alexey Tyurin.
Vulnerable:	SAP NetWeaver 7.30 SAP NetWeaver 7.02
Not Vulnerable:

SAP NetWeaver CVE-2014-8592 Multiple Denial of Service Vulnerabilities

SAP NetWeaver is prone to multiple remote denial-of-service vulnerabilities.

An attacker can exploit these issues to exhaust available CPU and memory resources, denying service to legitimate users

SAP NetWeaver 7.02, and 7.30 are vulnerable; other versions may also be affected.

SAP NetWeaver CVE-2014-8592 Multiple Denial of Service Vulnerabilities

Attackers can use readily available network utilities to exploit these issues.

SAP NetWeaver CVE-2014-8592 Multiple Denial of Service Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

SAP NetWeaver CVE-2014-8592 Multiple Denial of Service Vulnerabilities

References:

• [ERPSCAN-14-017] SAP NetWeaver HTTP �?? Partial HTTP POST requests DoS (ERPScan)
  
• [ERPSCAN-14-018] SAP NetWeaver J2EE Engine �?? Partial HTTP POST requests DoS (ERPScan)
  
• [ERPSCAN-14-019] SAP NetWeaver J2EE Engine �?? Partial HTTP requests DoS (ERPScan)
  
• [ERPSCAN-14-020] SAP NetWeaver Management Console (gSOAP) �?? Partial HTTP request (ERPScan)
  
• [ERPSCAN-14-021] SAP NetWeaver Management Console (gSOAP) �?? Partial HTTP POST re (ERPScan)
  
• Analyzing SAP Security Notes October 2014 Edition (Onapsis)
  
• Potential denial-of-service attack against SAP Start Service and SAP Host Agent (SAP)
  
• SAP Homepage (SAP)
  
• SAP NetWeaver - Homepage (SAP)