Executive Summary
Informations | |||
---|---|---|---|
Name | TA16-132A | First vendor Publication | 2016-05-11 |
Vendor | US-CERT | Last vendor Modification | 2016-05-11 |
Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:N/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 10 | Attack Range | Network |
Cvss Impact Score | 10 | Attack Complexity | Low |
Cvss Expoit Score | 10 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Overview At least 36 organizations worldwide are affected by an SAP vulnerability [1]. Security researchers from Onapsis discovered indicators of exploitation against these organizations’ SAP business applications. The observed indicators relate to the abuse of the Invoker Servlet, a built-in functionality in SAP NetWeaver Application Server Java systems (SAP Java platforms). The Invoker Servlet contains a vulnerability that was patched by SAP in 2010. However, the vulnerability continues to affect outdated and misconfigured SAP systems. DescriptionSAP systems running outdated or misconfigured software are exposed to increased risks of malicious attacks. The Invoker Servlet vulnerability affects business applications running on SAP Java platforms. SAP Java platforms are the base technology stack for many SAP business applications and technical components, including:
The vulnerability resides on the SAP application layer, so it is independent of the operating system and database application that support the SAP system. ImpactExploitation of the Invoker Servlet vulnerability gives unauthenticated remote attackers full access to affected SAP platforms, providing complete control of the business information and processes on these systems, as well as potential access to other systems. SolutionIn order to mitigate this vulnerability, US-CERT recommends users and administrators implement SAP Security Note 1445998 and disable the Invoker Servlet. For more mitigation details, please review the Onapsis threat report [1]. In addition, US-CERT encourages that users and administrators:
These recommendations apply to SAP systems in public, private, and hybrid cloud environments. Note: The U.S. Government does not endorse or support any particular product or vendor. |
Original Source
Url : http://www.us-cert.gov/cas/techalerts/TA16-132A.html |
CPE : Common Platform Enumeration
Snort® IPS/IDS
Date | Description |
---|---|
2016-07-28 | SAP servlet authentication bypass attempt RuleID : 39348 - Revision : 2 - Type : SERVER-WEBAPP |
Alert History
Date | Informations |
---|---|
2016-05-19 05:38:40 |
|
2016-05-13 17:36:40 |
|
2016-05-11 17:25:20 |
|