var-200511-0077
Vulnerability from variot

HTTP response splitting vulnerability in frameset.htm in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to inject arbitrary HTML headers via the sap-exiturl parameter. This issue is due to a failure in the application to properly sanitize user-supplied input. A remote attacker may exploit this vulnerability to influence or misrepresent how Web content is served, cached or interpreted. This could aid in various attacks that attempt to entice client users into a false sense of trust. This issue only affects the BSP runtime of SAP WAS.

1) Input passed to the "sap-syscmd" parameter in "fameset.htm" and the "BspApplication" field in the "SYSTEM PUBLIC" test application isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. Other versions may also be affected.

2) Input passed to the query string in pages generating error messages isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. Prior versions may also be affected.

3) The problem is that an absolute URL for an external site can be specified in the "sapexiturl" parameter passed to "fameset.htm". This can be exploited to trick users into visiting a malicious web site by following a specially crafted link with a trusted hostname redirecting to the malicious web site. Other versions may also be affected. Other versions may also be affected.

SOLUTION: The vendor has reportedly provided a solution for the vulnerabilities. Customers should contact the SAP's support for further information.

PROVIDED AND/OR DISCOVERED BY: Leandro Meiners, Cybsec S.A.

ORIGINAL ADVISORY: http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_Multiple_XSS_in_SAP_WAS.pdf http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_Phishing_Vector_in_SAP_WAS.pdf http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_HTTP_Response_Splitting_in_SAP_WAS.pdf

About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.

Subscribe: http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/

Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.

Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-200511-0077",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "web application server",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "sap",
        "version": "7.0"
      },
      {
        "model": "web application server",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "sap",
        "version": "6.40"
      },
      {
        "model": "web application server",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "sap",
        "version": "6.20"
      },
      {
        "model": "web application server",
        "scope": "eq",
        "trust": 1.9,
        "vendor": "sap",
        "version": "6.10"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "15360"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200511-201"
      },
      {
        "db": "NVD",
        "id": "CVE-2005-3633"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Leandro Meiners",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200511-201"
      }
    ],
    "trust": 0.6
  },
  "cve": "CVE-2005-3633",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "id": "CVE-2005-3633",
            "impactScore": 2.9,
            "integrityImpact": "PARTIAL",
            "severity": "MEDIUM",
            "trust": 1.0,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2005-3633",
            "trust": 1.0,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-200511-201",
            "trust": 0.6,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200511-201"
      },
      {
        "db": "NVD",
        "id": "CVE-2005-3633"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "HTTP response splitting vulnerability in frameset.htm in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to inject arbitrary HTML headers via the sap-exiturl parameter. This issue is due to a failure in the application to properly sanitize user-supplied input. \nA remote attacker may exploit this vulnerability to influence or misrepresent how Web content is served, cached or interpreted. This could aid in various attacks that attempt to entice client users into a false sense of trust. \nThis issue only affects the BSP runtime of SAP WAS. \r\n\r\n1) Input passed to the \"sap-syscmd\" parameter in \"fameset.htm\" and\nthe \"BspApplication\" field in the \"SYSTEM PUBLIC\" test application\nisn\u0027t properly sanitised before being returned to the user. This can\nbe exploited to execute arbitrary HTML and script code in a user\u0027s\nbrowser session in context of an affected site. \nOther versions may also be affected. \r\n\r\n2) Input passed to the query string in pages generating error\nmessages isn\u0027t properly sanitised before being returned to the user. \nThis can be exploited to execute arbitrary HTML and script code in a\nuser\u0027s browser session in context of an affected site. Prior versions may also be\naffected. \r\n\r\n3) The problem is that an absolute URL for an external site can be\nspecified in the \"sapexiturl\" parameter passed to \"fameset.htm\". This\ncan be exploited to trick users into visiting a malicious web site by\nfollowing a specially crafted link with a trusted hostname\nredirecting to the malicious web site. \nOther versions may also be affected. \nOther versions may also be affected. \n\nSOLUTION:\nThe vendor has reportedly provided a solution for the\nvulnerabilities. Customers should contact the SAP\u0027s support for\nfurther information. \n\nPROVIDED AND/OR DISCOVERED BY:\nLeandro Meiners, Cybsec S.A. \n\nORIGINAL ADVISORY:\nhttp://www.cybsec.com/vuln/CYBSEC_Security_Advisory_Multiple_XSS_in_SAP_WAS.pdf\r\nhttp://www.cybsec.com/vuln/CYBSEC_Security_Advisory_Phishing_Vector_in_SAP_WAS.pdf\r\nhttp://www.cybsec.com/vuln/CYBSEC_Security_Advisory_HTTP_Response_Splitting_in_SAP_WAS.pdf\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2005-3633"
      },
      {
        "db": "BID",
        "id": "15360"
      },
      {
        "db": "PACKETSTORM",
        "id": "41457"
      }
    ],
    "trust": 1.26
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "15360",
        "trust": 1.9
      },
      {
        "db": "SECUNIA",
        "id": "17515",
        "trust": 1.7
      },
      {
        "db": "SECTRACK",
        "id": "1015174",
        "trust": 1.6
      },
      {
        "db": "NVD",
        "id": "CVE-2005-3633",
        "trust": 1.6
      },
      {
        "db": "SREASON",
        "id": "164",
        "trust": 1.6
      },
      {
        "db": "OSVDB",
        "id": "20714",
        "trust": 1.6
      },
      {
        "db": "VUPEN",
        "id": "ADV-2005-2361",
        "trust": 1.6
      },
      {
        "db": "XF",
        "id": "23030",
        "trust": 0.6
      },
      {
        "db": "BUGTRAQ",
        "id": "20051109 CYBSEC - SECURITY ADVISORY: HTTP RESPONSE SPLITTING IN SAP WAS",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200511-201",
        "trust": 0.6
      },
      {
        "db": "PACKETSTORM",
        "id": "41457",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "15360"
      },
      {
        "db": "PACKETSTORM",
        "id": "41457"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200511-201"
      },
      {
        "db": "NVD",
        "id": "CVE-2005-3633"
      }
    ]
  },
  "id": "VAR-200511-0077",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.50441176
  },
  "last_update_date": "2024-11-23T22:15:24.893000Z",
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "NVD-CWE-Other",
        "trust": 1.0
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2005-3633"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 1.7,
        "url": "http://secunia.com/advisories/17515/"
      },
      {
        "trust": 1.7,
        "url": "http://www.cybsec.com/vuln/cybsec_security_advisory_http_response_splitting_in_sap_was.pdf"
      },
      {
        "trust": 1.6,
        "url": "http://www.securitytracker.com/alerts/2005/nov/1015174.html"
      },
      {
        "trust": 1.6,
        "url": "http://www.securityfocus.com/bid/15360/"
      },
      {
        "trust": 1.6,
        "url": "http://www.osvdb.org/20714"
      },
      {
        "trust": 1.6,
        "url": "http://securityreason.com/securityalert/164"
      },
      {
        "trust": 1.2,
        "url": "http://marc.theaimsgroup.com/?l=bugtraq\u0026m=113156438708932\u0026w=2"
      },
      {
        "trust": 1.0,
        "url": "http://www.vupen.com/english/advisories/2005/2361"
      },
      {
        "trust": 1.0,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/23030"
      },
      {
        "trust": 1.0,
        "url": "http://marc.info/?l=bugtraq\u0026m=113156438708932\u0026w=2"
      },
      {
        "trust": 0.6,
        "url": "http://xforce.iss.net/xforce/xfdb/23030"
      },
      {
        "trust": 0.6,
        "url": "http://www.frsirt.com/english/advisories/2005/2361"
      },
      {
        "trust": 0.3,
        "url": "http://www.sap.com"
      },
      {
        "trust": 0.3,
        "url": "/archive/1/416148"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/product/6087/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/secunia_security_advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/about_secunia_advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://www.cybsec.com/vuln/cybsec_security_advisory_multiple_xss_in_sap_was.pdf"
      },
      {
        "trust": 0.1,
        "url": "http://www.cybsec.com/vuln/cybsec_security_advisory_phishing_vector_in_sap_was.pdf"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/product/3327/"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "15360"
      },
      {
        "db": "PACKETSTORM",
        "id": "41457"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200511-201"
      },
      {
        "db": "NVD",
        "id": "CVE-2005-3633"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "BID",
        "id": "15360"
      },
      {
        "db": "PACKETSTORM",
        "id": "41457"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200511-201"
      },
      {
        "db": "NVD",
        "id": "CVE-2005-3633"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2005-11-09T00:00:00",
        "db": "BID",
        "id": "15360"
      },
      {
        "date": "2005-11-10T23:56:45",
        "db": "PACKETSTORM",
        "id": "41457"
      },
      {
        "date": "2005-11-16T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200511-201"
      },
      {
        "date": "2005-11-16T21:22:00",
        "db": "NVD",
        "id": "CVE-2005-3633"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2005-11-09T00:00:00",
        "db": "BID",
        "id": "15360"
      },
      {
        "date": "2005-11-23T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200511-201"
      },
      {
        "date": "2024-11-21T00:02:18.257000",
        "db": "NVD",
        "id": "CVE-2005-3633"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200511-201"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP Web Application Server in frameset.htm of HTTP Response split vulnerability",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200511-201"
      }
    ],
    "trust": 0.6
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "input validation",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200511-201"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.