ERPSCAN Research Advisory [ERPSCAN-15-012] SAP Afaria 7 XComms – Buffer Overflow
ERPScan inc <[email protected]> Fri, 14 Aug 2015 18:53:54 +0300
| Newsgroups | gmane.comp.security.fulldisclosure,gmane.comp.security.penetration,gmane.comp.security.news.securitytracker,gmane.comp.security.bugtraq |
|---|---|
| Message-ID | <CANHWe936T5XNLyhEFkkKEgPX5+josiP+rMEWkq=A40XKYk=YbA@mail.gmail.com> |
QXBwbGljYXRpb246IFNBUCBBZmFyaWEgNwpWZXJzaW9ucyBBZmZlY3RlZDogU0FQIEFmYXJpYSA3 LCBwcm9iYWJseSBvdGhlcnMKVmVuZG9yIFVSTDogaHR0cDovL1NBUC5jb20KQnVnczogQnVmZmVy IE92ZXJmbG93ClNlbnQ6IDEzLjAzLjIwMTUKUmVwb3J0ZWQ6IDE0LjAzLjIwMTUKVmVuZG9yIHJl c3BvbnNlOiAgICAgICAgICAgICAgICAxNC4wMy4yMDE1CkRhdGUgb2YgUHVibGljIEFkdmlzb3J5 OiAgICAgICAgMTguMDUuMjAxNQpSZWZlcmVuY2U6IFNBUCBTZWN1cml0eSBOb3RlIDIxNTM2OTAK QXV0aG9yOiBEbWl0cnkgQ2hhc3R1a2hpbiAoRVJQU2NhbikKCgoKRGVzY3JpcHRpb24KCgoKMS4g QURWSVNPUlkgSU5GT1JNQVRJT04KVGl0bGU6IFNBUCBBZmFyaWEgNwpBZHZpc29yeSBJRDogW0VS UFNDQU4tMTUtMDEyXQpSaXNrOiBIaWdoCkFkdmlzb3J5IFVSTDoKaHR0cDovL2VycHNjYW4uY29t L2Fkdmlzb3JpZXMvZXJwc2Nhbi0xNS0wMTItc2FwLWFmYXJpYS03LXhjb21tcy1ib2YvCkRhdGUg cHVibGlzaGVkOiAxOC4wNS4yMDE1ClZlbmRvcnMgY29udGFjdGVkOiBTQVAKCgoyLiBWVUxORVJB QklMSVRZIElORk9STUFUSU9OCkNsYXNzOiBYTUwgRXh0ZXJuYWwgRW50aXR5IFtDV0UtMTIxXQpJ bXBhY3Q6IEluZm9ybWF0aW9uIGRpc2Nsb3N1cmUsIERvUwpSZW1vdGVseSBFeHBsb2l0YWJsZTog WWVzCkxvY2FsbHkgRXhwbG9pdGFibGU6IE5vCkNWRSBOYW1lOiBDVkUtMjAxNS00MDkyCgoKMy4g VlVMTkVSQUJJTElUWSBERVNDUklQVElPTgoxKSBCdWZmZXIgT3ZlcmZsb3c6IEEgdnVsbmVyYWJp bGl0eSBoYXMgYmVlbiBkaXNjb3ZlcmVkIGluIGNlcnRhaW4KbGFuZHNjYXBlIGNvbmZpZ3VyYXRp b25zIG9mIFNBUCBBZmFyaWEgdGhhdCB1dGlsaXplIFhDb21tcyBmb3IKY2xpZW50LXRvLXNlcnZl ciBjb21tdW5pY2F0aW9ucy4gWENvbW1zIGlzIG9ubHkgdXNlZCBmb3IgQW5kcm9pZCwgV2luZG93 cwpNb2JpbGUsIGFuZCBXaW4zMiBjbGllbnRzLgoyKSBJbmZvcm1hdGlvbiBEaXNjbG9zdXJlOiBB biBlbmNyeXB0ZWQgcGFzc3dvcmQgaXMgbGVmdCBpbiB0aGUgZmlsZSBzeXN0ZW0KdGhhdCBpcyBu b3QgbmVlZGVkIGZvciBzZXJ2ZXIgb3BlcmF0aW9uLiAoQ1ZTUyBTY29yZTogMS45LCBMTU58UE5O KQozKSBEZW5pYWwgb2YgU2VydmljZSAoRG9TKTogQW4gYXR0YWNrZXIgY2FuIHJlbW90ZWx5IGV4 cGxvaXQgdGhlIFNBUCBBZmFyaWEKUGFja2FnZSBTZXJ2ZXIsIHJlbmRlcmluZyBpdCwgYW5kIHBv dGVudGlhbGx5IHRoZSByZXNvdXJjZXMgdXRpbGl6ZWQgYnkgdGhlCkFmYXJpYSBzZXJ2ZXIsIHVu YXZhaWxhYmxlLiAoQ1ZTUyBTY29yZTogNy44LCBOTE58Tk5DKQoKCjQuIFZVTE5FUkFCTEUgUEFD S0FHRVMKU0FQIEFmYXJpYSA3Ck90aGVyIHZlcnNpb25zIGFyZSBwcm9iYWJseSBhZmZlY3RlZCB0 b28sIGJ1dCB0aGV5IHdlcmUgbm90IGNoZWNrZWQuCgoKNS4gU09MVVRJT05TIEFORCBXT1JLQVJP VU5EUwpNdWx0aXBsZSB2dWxuZXJhYmlsaXRpZXMgaGF2ZSBiZWVuIGRpc2NvdmVyZWQgaW4gY2Vy dGFpbiBsYW5kc2NhcGUKY29uZmlndXJhdGlvbnMgb2YgU0FQIEFmYXJpYS4gU0FQIGhhcyByZWxl YXNlZCBhIHNlY3VyaXR5IHBhdGNoIHRvIGFkZHJlc3MKdGhlIHZ1bG5lcmFiaWxpdGllcy4gU0FQ IHN0cm9uZ2x5IHJlY29tbWVuZHMgdGhhdCBjdXN0b21lcnMgdXBkYXRlIHRoZWlyCmxhbmRzY2Fw ZXMuClBhdGNoIEluc3RydWN0aW9uczoKMSkgRG93bmxvYWQgaG90Zml4LgotIFNBUCBBZmFyaWEg NyBTUDU6IERvd25sb2FkIEhvdGZpeCAxMQoyKSBBcHBseSBzZXJ2ZXIgaG90Zml4IChTQVAgU2Vj dXJpdHkgTm90ZSAyMTUzNjkwKQpTQVAgdGFrZXMgYW55IHNlY3VyaXR5LXJlbGF0ZWQgcmVwb3J0 cyB2ZXJ5IHNlcmlvdXNseSwgYW5kIHdlIHdpbGwgbm90aWZ5Cm91ciBjdXN0b21lcnMgYXMgcmVs ZXZhbnQgbmV3IGluZm9ybWF0aW9uIG9uIHRoaXMgdG9waWMgYmVjb21lcyBhdmFpbGFibGUuCkN1 c3RvbWVycyBtYXkgYWxzbyBjb250YWN0IFNBUCBzdXBwb3J0IGJ5IHJhaXNpbmcgYSBjdXN0b21l ciBpbmNpZGVudCBvbgp0aGUgY29tcG9uZW50IE1PQi1BRkEuCgoKNi4gQVVUSE9SCkRtaXRyeSBD aGFzdHVraGluIChFUlBTY2FuKQoKCjcuIFRFQ0hOSUNBTCBERVNDUklQVElPTgpBbiBhdHRhY2tl ciBjYW4gZ2VuZXJhdGUgYW5kIHNlbmQgYSBzcGVjaWFsIHJlcXVlc3QgdG8gdGhlIHNlcnZlciB0 bwpleHBsb2l0IGEgYnVmZmVyIG92ZXJmbG93IHZ1bG5lcmFiaWxpdHkuCgoKOC4gUkVQT1JUIFRJ TUVMSU5FClNlbnQ6IDEzLjAzLjIwMTUKUmVwb3J0ZWQ6ICAgICAgICAgICAgICAgICAgICAgICAx NC4wMy4yMDE1ClZlbmRvciByZXNwb25zZTogICAgICAgICAgICAgICAgMTQuMDMuMjAxNQpEYXRl IG9mIFB1YmxpYyBBZHZpc29yeTogICAgICAgIDE4LjA1LjIwMTUKCgo5LiBSRUZFUkVOQ0VTCmh0 dHA6Ly9lcnBzY2FuLmNvbS9hZHZpc29yaWVzL2VycHNjYW4tMTUtMDEyLXNhcC1hZmFyaWEtNy14 Y29tbXMtYm9mLwoKCjEwLiBBQk9VVCBFUlBTY2FuIFJlc2VhcmNoClRoZSBjb21wYW554oCZcyBl eHBlcnRpc2UgaXMgYmFzZWQgb24gdGhlIHJlc2VhcmNoIHN1YmRpdmlzaW9uIG9mIEVSUFNjYW4s CndoaWNoIGlzIGVuZ2FnZWQgaW4gdnVsbmVyYWJpbGl0eSByZXNlYXJjaCBhbmQgYW5hbHlzaXMg b2YgY3JpdGljYWwKZW50ZXJwcmlzZSBhcHBsaWNhdGlvbnMuIEl0IGhhcyBhY2hpZXZlZCBtdWx0 aXBsZSBhY2tub3dsZWRnbWVudHMgZnJvbSB0aGUKbGFyZ2VzdCBzb2Z0d2FyZSB2ZW5kb3JzIGxp a2UgU0FQLCBPcmFjbGUsIE1pY3Jvc29mdCwgSUJNLCBWTXdhcmUsIEhQIGZvcgpkaXNjb3Zlcmlu ZyBtb3JlIHRoYW4gNDAwIHZ1bG5lcmFiaWxpdGllcyBpbiB0aGVpciBzb2x1dGlvbnMgKDIwMCBv ZiB0aGVtCmp1c3QgaW4gU0FQISkuCkVSUFNjYW4gcmVzZWFyY2hlcnMgYXJlIHByb3VkIHRvIGhh dmUgZXhwb3NlZCBuZXcgdHlwZXMgb2YgdnVsbmVyYWJpbGl0aWVzCihUT1AgMTAgV2ViIEhhY2tp bmcgVGVjaG5pcXVlcyAyMDEyKSBhbmQgdG8gYmUgbm9taW5hdGVkIGZvciB0aGUgYmVzdApzZXJ2 ZXItc2lkZSB2dWxuZXJhYmlsaXR5IGF0IEJsYWNrSGF0IDIwMTMuCkVSUFNjYW4gZXhwZXJ0cyBo YXZlIGJlZW4gaW52aXRlZCB0byBzcGVhaywgcHJlc2VudCwgYW5kIHRyYWluIGF0IDYwKyBwcmlt ZQppbnRlcm5hdGlvbmFsIHNlY3VyaXR5IGNvbmZlcmVuY2VzIGluIDI1KyBjb3VudHJpZXMgYWNy b3NzIHRoZSBjb250aW5lbnRzLgpUaGVzZSBpbmNsdWRlIEJsYWNrSGF0LCBSU0EsIEhJVEIsIGFu ZCBwcml2YXRlIFNBUCB0cmFpbmluZ3MgaW4gc2V2ZXJhbApGb3J0dW5lIDIwMDAgY29tcGFuaWVz LgpFUlBTY2FuIHJlc2VhcmNoZXJzIGxlYWQgdGhlIHByb2plY3QgRUFTLVNFQywgd2hpY2ggaXMg Zm9jdXNlZCBvbgplbnRlcnByaXNlIGFwcGxpY2F0aW9uIHNlY3VyaXR5IHJlc2VhcmNoIGFuZCBh d2FyZW5lc3MuIFRoZXkgaGF2ZSBwdWJsaXNoZWQKMyBleGhhdXN0aXZlIGFubnVhbCBhd2FyZC13 aW5uaW5nIHN1cnZleXMgYWJvdXQgU0FQIHNlY3VyaXR5LgpFUlBTY2FuIGV4cGVydHMgaGF2ZSBi ZWVuIGludGVydmlld2VkIGJ5IGxlYWRpbmcgbWVkaWEgcmVzb3VyY2VzIGFuZApmZWF0dXJlZCBp biBzcGVjaWFsaXplZCBpbmZvLXNlYyBwdWJsaWNhdGlvbnMgd29ybGR3aWRlLiBUaGVzZSBpbmNs dWRlClJldXRlcnMsIFlhaG9vLCBTQyBNYWdhemluZSwgVGhlIFJlZ2lzdGVyLCBDSU8sIFBDIFdv cmxkLCBEYXJrUmVhZGluZywKSGVpc2UsIGFuZCBDaGluYWJ5dGUsIHRvIG5hbWUgYSBmZXcuCldl IGhhdmUgaGlnaGx5IHF1YWxpZmllZCBleHBlcnRzIGluIHN0YWZmIHdpdGggZXhwZXJpZW5jZSBp biBtYW55IGRpZmZlcmVudApmaWVsZHMgb2Ygc2VjdXJpdHksIGZyb20gd2ViIGFwcGxpY2F0aW9u cyBhbmQgbW9iaWxlL2VtYmVkZGVkIHRvIHJldmVyc2UKZW5naW5lZXJpbmcgYW5kIElDUy9TQ0FE QSBzeXN0ZW1zLCBhY2N1bXVsYXRpbmcgdGhlaXIgZXhwZXJpZW5jZSB0byBjb25kdWN0CnRoZSBi ZXN0IFNBUCBzZWN1cml0eSByZXNlYXJjaC4KCgoxMS4gQUJPVVQgRVJQU2NhbgpFUlBTY2FuIGlz IG9uZSBvZiB0aGUgbW9zdCByZXNwZWN0ZWQgYW5kIGNyZWRpYmxlIEJ1c2luZXNzIEFwcGxpY2F0 aW9uClNlY3VyaXR5IHByb3ZpZGVycy4gRm91bmRlZCBpbiAyMDEwLCB0aGUgY29tcGFueSBvcGVy YXRlcyBnbG9iYWxseS4KTmFtZWQgYW4gRW1lcmdpbmcgdmVuZG9yIGluIFNlY3VyaXR5IGJ5IENS TiBhbmQgZGlzdGluZ3Vpc2hlZCBieSBtb3JlIHRoYW4KMjUgb3RoZXIgYXdhcmRzLCBFUlBTY2Fu IGlzIHRoZSBsZWFkaW5nIFNBUCBTRSBwYXJ0bmVyIGluIGRpc2NvdmVyaW5nIGFuZApyZXNvbHZp bmcgc2VjdXJpdHkgdnVsbmVyYWJpbGl0aWVzLiBFUlBTY2FuIGNvbnN1bHRhbnRzIHdvcmsgd2l0 aCBTQVAgU0UgaW4KV2FsbGRvcmYgdG8gaW1wcm92ZSB0aGUgc2VjdXJpdHkgb2YgdGhlaXIgbGF0 ZXN0IHNvbHV0aW9ucy4KRVJQU2NhbuKAmXMgcHJpbWFyeSBtaXNzaW9uIGlzIHRvIGNsb3NlIHRo ZSBnYXAgYmV0d2VlbiB0ZWNobmljYWwgYW5kCmJ1c2luZXNzIHNlY3VyaXR5LiBXZSBwcm92aWRl IHNvbHV0aW9ucyB0byBzZWN1cmUgRVJQIHN5c3RlbXMgYW5kCmJ1c2luZXNzLWNyaXRpY2FsIGFw cGxpY2F0aW9ucyBmcm9tIGJvdGggY3liZXIgYXR0YWNrcyBhbmQgaW50ZXJuYWwgZnJhdWQuCk91 ciBjbGllbnRzIGFyZSB1c3VhbGx5IGxhcmdlIGVudGVycHJpc2VzLCBGb3J0dW5lIDIwMDAgY29t cGFuaWVzLCBhbmQKbWFuYWdlZCBzZXJ2aWNlIHByb3ZpZGVycyB3aG9zZSByZXF1aXJlbWVudHMg YXJlIHRvIGFjdGl2ZWx5IG1vbml0b3IgYW5kCm1hbmFnZSB0aGUgc2VjdXJpdHkgb2YgdmFzdCBT QVAgbGFuZHNjYXBlcyBvbiBhIGdsb2JhbCBzY2FsZS4KT3VyIGZsYWdzaGlwIHByb2R1Y3QgaXMg RVJQU2NhbiBTZWN1cml0eSBNb25pdG9yaW5nIFN1aXRlIGZvciBTQVAuIFRoaXMKbXVsdGkgYXdh cmQtd2lubmluZyBpbm5vdmF0aXZlIHNvZnR3YXJlIGlzIHRoZSBvbmx5IHNvbHV0aW9uIG9uIHRo ZSBtYXJrZXQKY2VydGlmaWVkIGJ5IFNBUCBTRSBjb3ZlcmluZyBhbGwgdGllcnMgb2YgU0FQIHNl Y3VyaXR5OiB2dWxuZXJhYmlsaXR5CmFzc2Vzc21lbnQsIHNvdXJjZSBjb2RlIHJldmlldywgYW5k IFNlZ3JlZ2F0aW9uIG9mIER1dGllcy4KVGhlIGxhcmdlc3QgY29tcGFuaWVzIGZyb20gZGl2ZXJz ZSBpbmR1c3RyaWVzIGxpa2Ugb2lsIGFuZCBnYXMsIGJhbmtpbmcsCnJldGFpbCwgZXZlbiBudWNs ZWFyIHBvd2VyIGluc3RhbGxhdGlvbnMgYXMgd2VsbCBhcyBjb25zdWx0aW5nIGNvbXBhbmllcwpo YXZlIHN1Y2Nlc3NmdWxseSBkZXBsb3llZCB0aGUgc29mdHdhcmUuIEVSUFNjYW4gU2VjdXJpdHkg TW9uaXRvcmluZyBTdWl0ZQpmb3IgU0FQIGlzIHNwZWNpZmljYWxseSBkZXNpZ25lZCBmb3IgZW50 ZXJwcmlzZXMgdG8gY29udGludW91c2x5IG1vbml0b3IKY2hhbmdlcyBpbiBtdWx0aXBsZSBTQVAg c3lzdGVtcy4gSXQgZ2VuZXJhdGVzIGFuZCBhbmFseXplcyB0cmVuZHMgaW4gdXNlcgpmcmllbmRs eSBkYXNoYm9hcmRzLCBtYW5hZ2VzIHJpc2tzLCB0YXNrcywgYW5kIGNhbiBleHBvcnQgcmVzdWx0 cyB0bwpleHRlcm5hbCBzeXN0ZW1zLiBUaGVzZSBmZWF0dXJlcyBlbmFibGUgY2VudHJhbCBtYW5h Z2VtZW50IG9mIFNBUCBzeXN0ZW0Kc2VjdXJpdHkgd2l0aCBtaW5pbWFsIHRpbWUgYW5kIGVmZm9y dC4KV2UgZm9sbG93IHRoZSBzdW4gYW5kIGZ1bmN0aW9uIGluIHR3byBodWJzIGxvY2F0ZWQgaW4g dGhlIE5ldGhlcmxhbmRzIGFuZAp0aGUgVVMgdG8gb3BlcmF0ZSBsb2NhbCBvZmZpY2VzIGFuZCBw YXJ0bmVyIG5ldHdvcmsgc3Bhbm5pbmcgMjArIGNvdW50cmllcwphcm91bmQgdGhlIGdsb2JlLiBU aGlzIGVuYWJsZXMgbW9uaXRvcmluZyBjeWJlciB0aHJlYXRzIGluIHJlYWwgdGltZSBhbmQKcHJv dmlkaW5nIGFnaWxlIGN1c3RvbWVyIHN1cHBvcnQuCgoKQWRkcmVzcyBVU0E6IDIyOCBIYW1pbHRv biBBdmVudWUsIEZsLiAzLCBQYWxvIEFsdG8sIENBLCA5NDMwMQpQaG9uZTogNjUwLjc5OC41MjU1 ClR3aXR0ZXI6IEBlcnBzY2FuClNjb29wLWl0OiBCdXNpbmVzcyBBcHBsaWNhdGlvbiBTZWN1cml0 eQpodHRwOi8vZXJwc2Nhbi5jb20KLS0KPGh0dHBzOi8vd3d3LmxpbmtlZGluLmNvbS9jb21wYW55 LzIyMTc0NzQ/dHJrPXBwcm9fY3Byb2Y+CjxodHRwczovL3R3aXR0ZXIuY29tL2VycHNjYW4+Cjxo dHRwOi8vZXJwc2Nhbi5jb20vPgoKX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX18KU2VudCB0aHJvdWdoIHRoZSBGdWxsIERpc2Nsb3N1cmUgbWFpbGluZyBsaXN0 Cmh0dHBzOi8vbm1hcC5vcmcvbWFpbG1hbi9saXN0aW5mby9mdWxsZGlzY2xvc3VyZQpXZWIgQXJj aGl2ZXMgJiBSU1M6IGh0dHA6Ly9zZWNsaXN0cy5vcmcvZnVsbGRpc2Nsb3N1cmUv