‘SAP Enterprise Portal Path Disclosure Vulnerability’

Summary

A Path Disclosure vulnerability was identified affecting SAP Enterprise Portal.’

Credit:

‘The information has been provided by Mariano Nu ez Di Croce.
The original article can be found at: http://seclists.org/fulldisclosure/2011/Apr/450


Details

Vulnerable Systems:
 * EPBC2 7.00-7.02
 * EP-PSERV 6.0_640
 * EP-BASIS 7.10-7.11
 * EP-BASIS 7.20
 * EP-BASIS 7.31

By exploiting this vulnerability, an internal or external attacker would be able to obtain sensitive technical information from a vulnerable SAP Enterprise Portal system.

It has been detected that the Enterprise Portal runtime presents descriptive error messages when special HTTP requests are processed, returning information about the filesystem structure were the component is deployed in the target system.

Further technical details about this issue are not disclosed at this moment with the purpose of providing enough time to affected customers to patch their systems and protect against the exploitation of the described vulnerability.

Patch Availability:
SAP has released SAP Note 1513182 which provide patched versions of the affected components.
The patches can be downloaded from
https://service.sap.com/sap/support/notes/1513182.

Disclosure Timeline:
2010-09-22: Vulnerability information to SAP.
2010-09-23: SAP confirms reception of vulnerability submission.
2011-01-11: SAP releases security patches.
2011-04-19: Security advisory to security mailing lists.’

Categories: News