Layer Seven Security ADVISORY

Transcription

1 Layer Seven Security ADVISORY SAP Security Notes March 2015

2 SAP released an important announcement on Patch Tuesday in March to spotlight Security Notes , , and The Notes relate to missing authorization checks and buffer overflow, XXE and denial of service vulnerabilities relating to Afaria, Mobile Platform and SQL Anywhere. Although the Notes do not carry significant CVSS scores, the announcement is warranted given the direct impact to Internet-facing areas that could be targeted by remote attackers. Notes , and patch SQL injection vulnerabilities in SAP Configure, Price and Quote used to develop sales proposals that could be exploited to m o d i f y d a t a b a s e d a t a. T h e recommendations within the Notes include limiting the activity level for specific tablelevel access for impacted roles to displayo n l y u s i n g a u t h o r i z a t i o n o b j e c t S_TABU_DIS. Note deals with a high priority information disclosure vulnerability in Business Explorer, the front end component for Business Warehouse. The vulnerability could be exploited to discover installed applications and components, product versions, landscape configuration data and user passwords. This could be abused to target both BW and the NetWeaver Application Server. SAP Security Notes March 2015 Note also patches a serious information disclosure vulnerability caused by a weakness in the CCMS that could lead to the reading of values for profile parameters. Customers are advised to upgrade kernel patch levels to remove the vulnerability.

3 SAP Security Notes by Vulnerability Type Note patches a flaw in the Security Audit Log (SAL). Log records in SAL should log the IP address of users for configured events when the undocumented profile parameter rsau/ip_only is set to 1. However, for specific RFC-related events, only partial IP addresses are logged. The relevant kernel patches specified in Note should be applied to support the logging of complete IP addresses. Finally, Note provides corrections for a Cross-Application Scripting (XAS) vulnerability impacting Apache Cordova embedded within the Android Hybrid Web Container of the SAP Mobile Platform. XAS is a relatively rare vulnerability that executes in a similar fashion to Cross-Site Scripting attacks that effect Web applications. The impact of both vulnerabilities is identical. If exploited, XAS could lead to the theft of sensitive information including logon credentials. The vulnerability only relates to earlier versions of the Mobile Platform. SAP Mobile Platform 3.0 uses an alternative to the Hybrid Web Container known as Kapsel SDK for application development.

4 Appendix: SAP Security Notes, March 2015 PRIORITY NOTE AREA DESCRIPTION HIGH BW-BEX-ET Potential information disclosure relating to NW Application Server and BW HIGH MOB-ONP-APP XXE vulnerability in SAP Mobile Platform HIGH PA-PAO Potential Buffer overflow in PA-PAO HIGH MOB-AFA Buffer overflow in SAP Afaria 7 XcListener HIGH MOB-AFA Missing authorization check in XCListener HIGH BC-SYB-SQA Potential denial of service in SAP SQL Anywhere HIGH FS-BA-IF-ERS Potential code injection in Extraction & Reporting Services HIGH MOB-SDK-HWC Hybrid Web Container vulnerable to XAS attack HIGH BI-BIP-LCM Unauthorized modification of displayed content in Promotion Management Application HIGH BC-CCM-MON Potential information disclosure relating to SAPCCMS HIGH BC-SRV-UKM Potential modification of persisted data in BC-SRV-UKM MEDIUM LO-SLC Potential disclosure of persisted data in SAP CPQ Solution Configuration MEDIUM TEST-623 Potential modif./disclosure of persisted data in SAP CPQ Solution Sales Configuration MEDIUM BC-CST-GW SAP Netweaver SAL incorrect logging in RFC functions MEDIUM MOB-AFA Cross-site Scripting issue in Afaria 7 SP5 Self-service Portal. MEDIUM MEDIUM XX-PROJ-CDP- EP-PIN-PCD-ROL- UPL FIN-FSCM-TRM-TM- TR XML External Entity vulnerability in SAP XML Parser Missing authorization check in Transaction Management MEDIUM MOB-AFA Unauthorized use of application functions in Afaria Server MEDIUM BW-BEX-ET-WJR Unauthorized modification of displayed content in BW-BEX-ET-WJR MEDIUM BC-JAS-SEC-LGN Unauthorized modification of displayed content in logon application MEDIUM BC-MID-RFC Protecting data against change to destination authorization LOW LO-SLC Potential modification of persisted data in SAP CPQ Solution Configuration (SME) LOW CRM-MKT-MPL-CA Unauthorized modification of displayed content in CRM-MKT-MPL-CA

5 Layer Seven Security empowers organisations to realize the potential of SAP systems. We serve customers worldwide to secure systems from cyber threats. We take an integrated approach to build layered controls for defense in depth Address Westbury Corporate Centre Suite Upper Middle Road Oakville, Ontario L6H 0C3, Canada Web Telephone

6 Copyright Layer Seven Security All rights reserved. No portion of this document may be reproduced in whole or in part without the prior written permission of Layer Seven Security. Layer Seven Security offers no specific guarantee regarding the accuracy or completeness of the information presented, but the professional staff of Layer Seven Security makes every reasonable effort to present the most reliable information available to it and to meet or exceed any applicable industry standards. This publication contains references to the products of SAP AG. SAP, R/3, xapps, xapp, SAP NetWeaver, Duet, PartnerEdge, ByDesign, SAP Business ByDesign, and other SAP products and services mentioned herein are trademarks or registered trademarks of SAP AG in Germany and in several other countries all over the world. Business Objects and the Business Objects logo, BusinessObjects, Crystal Reports, Crystal Decisions, Web Intelligence, Xcelsius and other Business Objects products and services mentioned herein are trademarks or registered trademarks of Business Objects in the United States and/or other countries. SAP AG is neither the author nor the publisher of this publication and is not responsible for its content, and SAP Group shall not be liable for errors or omissions with respect to the materials.