cnvd - cnvd-2021-29099

cnvd-2021-29099

Vulnerability from cnvd

Title: SAP NetWeaver AS ABAP拒绝服务漏洞（CNVD-2021-29099）

Description:

SAP Netweaver是德国思爱普（SAP）公司的一套面向服务的集成化应用平台。该平台主要为SAP应用程序提供开发和运行环境。

SAP NetWeaver AS ABAP 731、740和750版本存在拒绝服务漏洞。该漏洞源于程序启用了RFC的功能模块SPI_WAIT_MILLIS。攻击者可通过调用此功能模块利用该漏洞阻止所有工作流程，从而导致拒绝服务并影响SAP系统的可用性。

Severity: 中

Patch Name: SAP NetWeaver AS ABAP拒绝服务漏洞（CNVD-2021-29099）的补丁

Patch Description:

SAP Netweaver是德国思爱普（SAP）公司的一套面向服务的集成化应用平台。该平台主要为SAP应用程序提供开发和运行环境。

SAP NetWeaver AS ABAP 731、740和750版本存在拒绝服务漏洞。该漏洞源于程序启用了RFC的功能模块SPI_WAIT_MILLIS。攻击者可通过调用此功能模块利用该漏洞阻止所有工作流程，从而导致拒绝服务并影响SAP系统的可用性。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649

Reference: http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27603

Impacted products

Name
['SAP NetWeaver AS ABAP 731', 'SAP NetWeaver AS ABAP 740', 'SAP NetWeaver AS ABAP 750']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2021-27603",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2021-27603"
    }
  },
  "description": "SAP Netweaver\u662f\u5fb7\u56fd\u601d\u7231\u666e\uff08SAP\uff09\u516c\u53f8\u7684\u4e00\u5957\u9762\u5411\u670d\u52a1\u7684\u96c6\u6210\u5316\u5e94\u7528\u5e73\u53f0\u3002\u8be5\u5e73\u53f0\u4e3b\u8981\u4e3aSAP\u5e94\u7528\u7a0b\u5e8f\u63d0\u4f9b\u5f00\u53d1\u548c\u8fd0\u884c\u73af\u5883\u3002\n\nSAP NetWeaver AS ABAP 731\u3001740\u548c750\u7248\u672c\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u542f\u7528\u4e86RFC\u7684\u529f\u80fd\u6a21\u5757SPI_WAIT_MILLIS\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u8c03\u7528\u6b64\u529f\u80fd\u6a21\u5757\u5229\u7528\u8be5\u6f0f\u6d1e\u963b\u6b62\u6240\u6709\u5de5\u4f5c\u6d41\u7a0b\uff0c\u4ece\u800c\u5bfc\u81f4\u62d2\u7edd\u670d\u52a1\u5e76\u5f71\u54cdSAP\u7cfb\u7edf\u7684\u53ef\u7528\u6027\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u8fd9\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u8bf7\u5230\u5382\u5546\u7684\u4e3b\u9875\u4e0b\u8f7d\uff1a\r\nhttps://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-29099",
  "openTime": "2021-04-18",
  "patchDescription": "SAP Netweaver\u662f\u5fb7\u56fd\u601d\u7231\u666e\uff08SAP\uff09\u516c\u53f8\u7684\u4e00\u5957\u9762\u5411\u670d\u52a1\u7684\u96c6\u6210\u5316\u5e94\u7528\u5e73\u53f0\u3002\u8be5\u5e73\u53f0\u4e3b\u8981\u4e3aSAP\u5e94\u7528\u7a0b\u5e8f\u63d0\u4f9b\u5f00\u53d1\u548c\u8fd0\u884c\u73af\u5883\u3002\r\n\r\nSAP NetWeaver AS ABAP 731\u3001740\u548c750\u7248\u672c\u5b58\u5728\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u542f\u7528\u4e86RFC\u7684\u529f\u80fd\u6a21\u5757SPI_WAIT_MILLIS\u3002\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u8c03\u7528\u6b64\u529f\u80fd\u6a21\u5757\u5229\u7528\u8be5\u6f0f\u6d1e\u963b\u6b62\u6240\u6709\u5de5\u4f5c\u6d41\u7a0b\uff0c\u4ece\u800c\u5bfc\u81f4\u62d2\u7edd\u670d\u52a1\u5e76\u5f71\u54cdSAP\u7cfb\u7edf\u7684\u53ef\u7528\u6027\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "SAP NetWeaver AS ABAP\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff08CNVD-2021-29099\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "SAP NetWeaver AS ABAP 731",
      "SAP NetWeaver AS ABAP 740",
      "SAP NetWeaver AS ABAP 750"
    ]
  },
  "referenceLink": "http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27603",
  "serverity": "\u4e2d",
  "submitTime": "2021-04-16",
  "title": "SAP NetWeaver AS ABAP\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e\uff08CNVD-2021-29099\uff09"
}

CVE-2021-27603 (GCVE-0-2021-27603)

Vulnerability from cvelistv5

Published

2021-04-13 18:40

Modified

2024-08-03 21:26

Severity ?

6.5 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE

Denial of Service

Summary

An RFC enabled function module SPI_WAIT_MILLIS in SAP NetWeaver AS ABAP, versions - 731, 740, 750, allows to keep a work process busy for any length of time. An attacker could call this function module multiple times to block all work processes thereby causing Denial of Service and affecting the Availability of the SAP system.

References

▼	URL	Tags
	https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649	x_refsource_MISC
	https://launchpad.support.sap.com/#/notes/3028729	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	SAP SE	SAP NetWeaver AS for ABAP	Version: < 731 Version: < 740 Version: < 750

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T21:26:10.122Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://launchpad.support.sap.com/#/notes/3028729"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "SAP NetWeaver AS for ABAP",
          "vendor": "SAP SE",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 731"
            },
            {
              "status": "affected",
              "version": "\u003c 740"
            },
            {
              "status": "affected",
              "version": "\u003c 750"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An RFC enabled function module SPI_WAIT_MILLIS in SAP NetWeaver AS ABAP, versions - 731, 740, 750, allows to keep a work process busy for any length of time. An attacker could call this function module multiple times to block all work processes thereby causing Denial of Service and affecting the Availability of the SAP system."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Denial of Service",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-04-13T18:40:46",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://launchpad.support.sap.com/#/notes/3028729"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cna@sap.com",
          "ID": "CVE-2021-27603",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "SAP NetWeaver AS for ABAP",
                      "version": {
                        "version_data": [
                          {
                            "version_name": "\u003c",
                            "version_value": "731"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "740"
                          },
                          {
                            "version_name": "\u003c",
                            "version_value": "750"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "SAP SE"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An RFC enabled function module SPI_WAIT_MILLIS in SAP NetWeaver AS ABAP, versions - 731, 740, 750, allows to keep a work process busy for any length of time. An attacker could call this function module multiple times to block all work processes thereby causing Denial of Service and affecting the Availability of the SAP system."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": "6.5",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Denial of Service"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649",
              "refsource": "MISC",
              "url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=573801649"
            },
            {
              "name": "https://launchpad.support.sap.com/#/notes/3028729",
              "refsource": "MISC",
              "url": "https://launchpad.support.sap.com/#/notes/3028729"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2021-27603",
    "datePublished": "2021-04-13T18:40:46",
    "dateReserved": "2021-02-23T00:00:00",
    "dateUpdated": "2024-08-03T21:26:10.122Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted