Feeds

SAP NetWeaver flaw spews user tables

Patch issued but Ruskies keep details under wraps

  • alert
  • submit to reddit

Internet Security Threat Report 2014

Russian security researchers have reported a vulnerability in SAP NetWeaver which could allow attackers to gain access to Central User Administration tables.

Details on the vulnerability (CVE-2014-3787) in the service-oriented and integration platform were kept under wraps by security firm PT Security which conducted regular tests on SAP kit.

The Central User Administration feature streamlined management of multiple users accounts that were managed on different clients. SAP was among the most popular business applications and was used by three quarters of Forbes 500 companies.

Dmitry Gutsko said the sensitive information disclosure vulnerability affected NetWeaver versions 7.20 and earlier.

"By successfully exploiting the vulnerability, an attacker can read any tables from SAP Central User Administration via accessing the affiliated system, which may lead to disclosure of user data stored in all CUA systems," Gutso said in a disclosure.

Users were advised to apply the latest NetWeaver security patches to fix the flaw.

SAP users were notorious bad at updating and securing their deployments. Last year ERP Scan founder Alexander Polyakov found hundreds of organisations ran vulnerable and old versions of SAP and had exposed deployments to the public internet.

Polyakov found many customers ran versions of NetWeaver j2EE that contained critical holes that allowed attackers to execute commands without authentication.

And in January this year the security company reported a critical XML External Entity (XXE) vulnerability within SAP NetWeaver's GRMGApp which was open to unauthorised access. ®

Secure remote control for conventional and virtual desktops

Whitepapers

Designing and building an open ITOA architecture
Learn about a new IT data taxonomy defined by the four data sources of IT visibility: wire, machine, agent, and synthetic data sets.
5 critical considerations for enterprise cloud backup
Key considerations when evaluating cloud backup solutions to ensure adequate protection security and availability of enterprise data.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Protecting against web application threats using SSL
SSL encryption can protect server‐to‐server communications, client devices, cloud resources, and other endpoints in order to help prevent the risk of data loss and losing customer trust.