Details of VAR-200704-0046

ID

VAR-200704-0046

CVE

CVE-2007-1916

TITLE

SAP RFC Library of RFC_START_GUI Buffer overflow vulnerability in functions

Trust: 0.8

sources: JVNDB: JVNDB-2007-005367

DESCRIPTION

Buffer overflow in the RFC_START_GUI function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to execute arbitrary code via unspecified vectors. NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended. An attacker could exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. ---------------------------------------------------------------------- Secunia customers receive relevant and filtered advisories. Delivery is done via different channels including SMS, Email, Web, and https based XML feed. http://corporate.secunia.com/trial/38/request/ ---------------------------------------------------------------------- TITLE: SAP RFC Library Multiple Vulnerabilities SECUNIA ADVISORY ID: SA24722 VERIFY ADVISORY: http://secunia.com/advisories/24722/ CRITICAL: Moderately critical IMPACT: Exposure of sensitive information, DoS, System access WHERE: >From local network SOFTWARE: SAP RFC Library 7.x http://secunia.com/product/13851/ SAP RFC Library 6.x http://secunia.com/product/13850/ DESCRIPTION: Mariano Nu\xf1ez Di Croce has reported some vulnerabilities in SAP RFC Library, which can be exploited by malicious people to disclose potentially sensitive information, cause a DoS (Denial of Service), and compromise a vulnerable system. 1) The "RFC_SET_REG_SERVER_PROPERTY" RFC function allows to define the exclusive use of the RFC Server. This can be exploited to cause a DoS by denying access to other clients. 4) Two unspecified errors exist within the "RFC_START_PROGRAM" RFC function. 5) An error within the "TRUSTED_SYSTEM_SECURITY" function can be exploited to gain knowledge about existing user accounts and groups on a RFC server. The vulnerabilities are reported in SAP RFC Library versions 6.40 and 7.00. Other versions may also be affected. SOLUTION: Reportedly, SAP released patches. PROVIDED AND/OR DISCOVERED BY: Mariano Nu\xf1ez Di Croce ORIGINAL ADVISORY: http://www.cybsec.com/vuln/CYBSEC-Security_Advisory_SAP_RFC_SET_REG_SERVER_PROPERTY_RFC_Function_Denial_of_Service.pdf http://www.cybsec.com/vuln/CYBSEC-Security_Advisory_SAP_RFC_START_GUI_RFC_Function_Buffer_Overflow.pdf http://www.cybsec.com/vuln/CYBSEC-Security_Advisory_SAP_RFC_START_PROGRAM_RFC_Function_Multiple_Vulnerabilities.pdf http://www.cybsec.com/vuln/CYBSEC-Security_Advisory_SAP_SYSTEM_CREATE_INSTANCE_RFC_Function_Buffer_Overflow.pdf http://www.cybsec.com/vuln/CYBSEC-Security_Advisory_SAP_TRUSTED_SYSTEM_SECURITY_RFC_Function_Information_Disclosure.pdf ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.07

sources: NVD: CVE-2007-1916 // JVNDB: JVNDB-2007-005367 // BID: 23304 // VULHUB: VHN-25278 // PACKETSTORM: 55699

AFFECTED PRODUCTS

vendor:	sap	model:	rfc library	scope:	eq	version:	7.0	Trust: 1.0
vendor:	sap	model:	rfc library	scope:	eq	version:	6.4	Trust: 1.0
vendor:	sap	model:	rfc library	scope:	eq	version:	6.40 20061211	Trust: 0.8
vendor:	sap	model:	rfc library	scope:	lt	version:	7.00	Trust: 0.8
vendor:	hp	model:	tru64	scope:	-	version:	-	Trust: 0.6
vendor:	hp	model:	hp-ux	scope:	-	version:	-	Trust: 0.6
vendor:	apple	model:	mac os	scope:	-	version:	-	Trust: 0.6
vendor:	sap	model:	rfc library	scope:	eq	version:	7.00	Trust: 0.3
vendor:	sap	model:	rfc library	scope:	eq	version:	6.40	Trust: 0.3

sources: BID: 23304 // JVNDB: JVNDB-2007-005367 // CNNVD: CNNVD-200704-168 // NVD: CVE-2007-1916

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2007-1916
value:	HIGH
Trust: 1.0
NVD:	CVE-2007-1916
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-200704-168
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-25278
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2007-1916
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-25278
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: VULHUB: VHN-25278 // JVNDB: JVNDB-2007-005367 // CNNVD: CNNVD-200704-168 // NVD: CVE-2007-1916

PROBLEMTYPE DATA

problemtype:

NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2007-1916

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200704-168

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-200704-168

CONFIGURATIONS

sources: JVNDB: JVNDB-2007-005367

PATCH

title:	Top Page	url:	http://www.sap.com/index.epx	Trust: 0.8
title:	SAP RFC_START_GUI RFC Fixes for function buffer error vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=163494	Trust: 0.6

sources: JVNDB: JVNDB-2007-005367 // CNNVD: CNNVD-200704-168

EXTERNAL IDS

db:	NVD	id:	CVE-2007-1916	Trust: 2.5
db:	BID	id:	23304	Trust: 2.0
db:	SECUNIA	id:	24722	Trust: 1.8
db:	SREASON	id:	2537	Trust: 1.7
db:	VUPEN	id:	ADV-2007-1270	Trust: 1.7
db:	JVNDB	id:	JVNDB-2007-005367	Trust: 0.8
db:	CNNVD	id:	CNNVD-200704-168	Trust: 0.7
db:	VULHUB	id:	VHN-25278	Trust: 0.1
db:	PACKETSTORM	id:	55699	Trust: 0.1

sources: VULHUB: VHN-25278 // BID: 23304 // JVNDB: JVNDB-2007-005367 // PACKETSTORM: 55699 // CNNVD: CNNVD-200704-168 // NVD: CVE-2007-1916

REFERENCES

url:	http://www.cybsec.com/vuln/cybsec-security_advisory_sap_rfc_start_gui_rfc_function_buffer_overflow.pdf	Trust: 2.1
url:	http://www.securityfocus.com/bid/23304	Trust: 1.7
url:	http://www.securityfocus.com/archive/1/464680/100/0/threaded	Trust: 1.7
url:	http://secunia.com/advisories/24722	Trust: 1.7
url:	http://securityreason.com/securityalert/2537	Trust: 1.7
url:	http://www.vupen.com/english/advisories/2007/1270	Trust: 1.7
url:	https://exchange.xforce.ibmcloud.com/vulnerabilities/33420	Trust: 1.7
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-1916	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2007-1916	Trust: 0.8
url:	http://www.sap.com	Trust: 0.3
url:	http://secunia.com/secunia_security_advisories/	Trust: 0.1
url:	http://secunia.com/product/13850/	Trust: 0.1
url:	http://corporate.secunia.com/trial/38/request/	Trust: 0.1
url:	http://secunia.com/product/13851/	Trust: 0.1
url:	http://www.cybsec.com/vuln/cybsec-security_advisory_sap_trusted_system_security_rfc_function_information_disclosure.pdf	Trust: 0.1
url:	http://secunia.com/advisories/24722/	Trust: 0.1
url:	http://www.cybsec.com/vuln/cybsec-security_advisory_sap_system_create_instance_rfc_function_buffer_overflow.pdf	Trust: 0.1
url:	http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org	Trust: 0.1
url:	http://www.cybsec.com/vuln/cybsec-security_advisory_sap_rfc_set_reg_server_property_rfc_function_denial_of_service.pdf	Trust: 0.1
url:	http://secunia.com/about_secunia_advisories/	Trust: 0.1
url:	http://www.cybsec.com/vuln/cybsec-security_advisory_sap_rfc_start_program_rfc_function_multiple_vulnerabilities.pdf	Trust: 0.1

sources: VULHUB: VHN-25278 // BID: 23304 // JVNDB: JVNDB-2007-005367 // PACKETSTORM: 55699 // CNNVD: CNNVD-200704-168 // NVD: CVE-2007-1916

CREDITS

Mariano Nuñez Di Croce※ mnunez@cybsec.com

Trust: 0.6

sources: CNNVD: CNNVD-200704-168

SOURCES

db:	VULHUB	id:	VHN-25278
db:	BID	id:	23304
db:	JVNDB	id:	JVNDB-2007-005367
db:	PACKETSTORM	id:	55699
db:	CNNVD	id:	CNNVD-200704-168
db:	NVD	id:	CVE-2007-1916

LAST UPDATE DATE

2024-11-23T21:57:14.576000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-25278	date:	2018-10-30T00:00:00
db:	BID	id:	23304	date:	2007-04-05T17:12:00
db:	JVNDB	id:	JVNDB-2007-005367	date:	2012-12-20T00:00:00
db:	CNNVD	id:	CNNVD-200704-168	date:	2021-09-23T00:00:00
db:	NVD	id:	CVE-2007-1916	date:	2024-11-21T00:29:27.473

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-25278	date:	2007-04-10T00:00:00
db:	BID	id:	23304	date:	2007-04-04T00:00:00
db:	JVNDB	id:	JVNDB-2007-005367	date:	2012-12-20T00:00:00
db:	PACKETSTORM	id:	55699	date:	2007-04-07T19:35:58
db:	CNNVD	id:	CNNVD-200704-168	date:	2007-04-10T00:00:00
db:	NVD	id:	CVE-2007-1916	date:	2007-04-10T23:19:00