[Onapsis Security Advisory 2015-013] SAP Business Objects Memory Corruption
Onapsis Research Team <[email protected]> Tue, 22 Sep 2015 15:10:36 -0300
| Newsgroups | gmane.comp.security.fulldisclosure,gmane.comp.security.bugtraq,gmane.comp.security.news.securitytracker,gmane.comp.security.penetration |
|---|---|
| Message-ID | <CAJCRPDu_zvZ=+C_M1r_4RpzZ-ekxGJ_-SzPOtRjZxotO1oGTGg@mail.gmail.com> |
LS0tLS1CRUdJTiBQR1AgU0lHTkVEIE1FU1NBR0UtLS0tLQpIYXNoOiBTSEExCgpPbmFwc2lzIFNl Y3VyaXR5IEFkdmlzb3J5IDIwMTUtMDEzOiBTQVAgQnVzaW5lc3MgT2JqZWN0cyBNZW1vcnkgQ29y cnVwdGlvbgoKMS4gSW1wYWN0IG9uIEJ1c2luZXNzCj09PT09PT09PT09PT09PT09PT09PQoKQnkg ZXhwbG9pdGluZyB0aGlzIHZ1bG5lcmFiaWxpdHkgYW4gdW5hdXRoZW50aWNhdGVkIGF0dGFja2Vy IGNvdWxkIHJlYWQgb3IKd3JpdGUKYW55IGJ1c2luZXNzLXJlbGV2YW50IGluZm9ybWF0aW9uIGZy b20gdGhlIEJ1c2luZXNzIEludGVsbGlnZW5jZSBQbGF0Zm9ybQphbmQgYWxzbwpyZW5kZXIgdGhl IHN5c3RlbSB1bmF2YWlsYWJsZSB0byBvdGhlciB1c2Vycy4KClJpc2sgTGV2ZWw6IEhpZ2gKCgoy LiBBZHZpc29yeSBJbmZvcm1hdGlvbgo9PT09PT09PT09PT09PT09PT09PT09PQoKKiBQdWJsaWMg UmVsZWFzZSBEYXRlOiAwOS8yMi8yMDE1CiogTGFzdCBSZXZpc2VkOiAwOS8yMi8yMDE1CiogU2Vj dXJpdHkgQWR2aXNvcnkgSUQ6IE9OQVBTSVMtMjAxNS0wMTMKKiBPbmFwc2lzIFNWUyBJRDogT05B UFNJUy0wMDEwNQoqIENWRTogIE4vQQoqIFJlc2VhcmNoZXI6IFdpbGwgVmFuZGV2YW50ZXIKKiBW ZW5kb3IgUHJvdmlkZWQgQ1ZTUyB2MjogNS4wIChBVjpOL0FDOkwvQXU6Ti9DOk4vSTpOL0E6QykK KiBPbmFwc2lzIENWU1MgdjI6IDkgKEFWOk4vQUM6TC9BdTpOL0M6UC9JOlAvQTpDKQoqIE9uYXBz aXMgQ1ZTUyB2MzogOC42IChDVlNTOjMuMC9BVjpOL0FDOkwvUFI6Ti9VSTpOL1M6VS9DOkwvSTpM L0E6SCkKCgozLiBWdWxuZXJhYmlsaXR5IEluZm9ybWF0aW9uCj09PT09PT09PT09PT09PT09PT09 PT09PT09PT0KKiBWZW5kb3I6ICBTQVAgQUcKKiBBZmZlY3RlZCBDb21wb25lbnRzOgogICogQnVz c2luZXNzT2JqZWN0cyBFZGdlIDQuMAogICogQnVzc2luZXNzT2JqZWN0cyBCSSBQbGF0Zm9ybSA0 LjEKICAqIEJPWEkgMy4xIFIzCgoqIFZ1bG5lcmFiaWxpdHkgQ2xhc3M6IEJ1ZmZlciBDb3B5IHdp dGhvdXQgQ2hlY2tpbmcgU2l6ZSBvZiBJbnB1dCAoQ1dFLTEyMCkKKiBSZW1vdGVseSBFeHBsb2l0 YWJsZTogWWVzCiogTG9jYWxseSBFeHBsb2l0YWJsZTogTm8KKiBBdXRoZW50aWNhdGlvbiBSZXF1 aXJlZDogTm8KKiBPcmlnaW5hbCBBZHZpc29yeToKaHR0cDovL3d3dy5vbmFwc2lzLmNvbS9yZXNl YXJjaC9zZWN1cml0eS1hZHZpc29yaWVzL1NBUC1CdXNpbmVzcy1PYmplY3RzLU1lbW9yeS1Db3Jy dXB0aW9uCgoKNC4gQWZmZWN0ZWQgQ29tcG9uZW50cyBEZXNjcmlwdGlvbgo9PT09PT09PT09PT09 PT09PT09PT09PT09PT09PT09PT09CgpCdXNpbmVzcyBPYmplY3RzIGlzIHBhcnQgb2YgdGhlIEJ1 c2luZXNzIEludGVsbGlnZW5jZSBwbGF0Zm9ybSBmcm9tIFNBUC4KSXQgaGFzIGNvbXBvbmVudHMg dGhhdCBwcm92aWRlIHBlcmZvcm1hbmNlIG1hbmFnZW1lbnQsIHBsYW5uaW5nLCByZXBvcnRpbmcs CnF1ZXJ5IGFuZCBhbmFseXNpcyBhbmQgZW50ZXJwcmlzZSBpbmZvcm1hdGlvbiBtYW5hZ2VtZW50 LgoKRXZlcnkgQnVzaW5lc3MgT2JqZWN0cyBpbnN0YWxsYXRpb24gcHJvdmlkZXMgYSB3ZWIgc2Vy dmljZSB0byBpbnRlcmFjdCB3aXRoCmRpZmZlcmVudCBwbGF0Zm9ybSBzZXJ2aWNlcy4KCjUuIFZ1 bG5lcmFiaWxpdHkgRGV0YWlscwo9PT09PT09PT09PT09PT09PT09PT09PT0KCkEgbWlzaGFuZGxp bmcgb2YgYSBtYWxmb3JtZWQgR0lPUCBwYWNrZXQgY2F1c2VzIHRoZSByZW1vdGUgbGlzdGVuZXIg dG8KY3Jhc2ggd2hpbGUgcmVhZGluZyBmcm9tIGludmFsaWQgbWVtb3J5LgoKCjYuIFNvbHV0aW9u Cj09PT09PT09PT09CgpJbXBsZW1lbnQgU0FQIFNlY3VyaXR5IE5vdGUgMjAwMTEwOC4KCgo3LiBS ZXBvcnQgVGltZWxpbmUKPT09PT09PT09PT09PT09PT09CgoxMi8yMy8yMDEzOiBPbmFwc2lzIHBy b3ZpZGVzIHZ1bG5lcmFiaWxpdHkgaW5mb3JtYXRpb24gdG8gU0FQIEFHLgoxMi8yNC8yMDEzOiBT QVAgQUcgY29uZmlybXMgcmVjZXB0aW9uIG9mIHZ1bG5lcmFiaWxpdHkgcmVwb3J0LgowMS8xNC8y MDE0OiBTQVAgcmVwb3J0cyBmaXggaXMgSW4gUHJvY2Vzcy4KMDUvMTIvMjAxNTogU0FQIHJlbGVh c2VzIFNBUCBTZWN1cml0eSBOb3RlIDIwMDExMDggZml4aW5nIHRoZSB2dWxuZXJhYmlsaXR5Lgow OS8yMi8yMDE1OiBPbmFwc2lzIFJlbGVhc2VzIFNlY3VyaXR5IEFkdmlzb3J5LgoKCkFib3V0IE9u YXBzaXMgUmVzZWFyY2ggTGFicwo9PT09PT09PT09PT09PT09PT09PT09PT09PT0KT25hcHNpcyBS ZXNlYXJjaCBMYWJzIHByb3ZpZGVzIHRoZSBpbmR1c3RyeSBhbmFseXNpcyBvZiBrZXkgc2VjdXJp dHkgaXNzdWVzCnRoYXQgaW1wYWN0IGJ1c2luZXNzLWNyaXRpY2FsCnN5c3RlbXMgYW5kIGFwcGxp Y2F0aW9ucy4gRGVsaXZlcmluZyBmcmVxdWVudCBhbmQgdGltZWx5IHNlY3VyaXR5IGFuZApjb21w bGlhbmNlIGFkdmlzb3JpZXMgd2l0aCBhc3NvY2lhdGVkCnJpc2sgbGV2ZWxzLCBPbmFwc2lzIFJl c2VhcmNoIExhYnMgY29tYmluZSBpbi1kZXB0aCBrbm93bGVkZ2UgYW5kCmV4cGVyaWVuY2UgdG8g ZGVsaXZlciB0ZWNobmljYWwgYW5kCmJ1c2luZXNzLWNvbnRleHQgd2l0aCBzb3VuZCBzZWN1cml0 eSBqdWRnbWVudCB0byB0aGUgYnJvYWRlciBpbmZvcm1hdGlvbgpzZWN1cml0eSBjb21tdW5pdHku CgoKQWJvdXQgT25hcHNpcywgSW5jLgo9PT09PT09PT09PT09PT09PT09CgpPbmFwc2lzIGdpdmVz IG9yZ2FuaXphdGlvbnMgdGhlIGFkYXB0aXZlIGFkdmFudGFnZSB0byBzdWNjZWVkIGluIHNlY3Vy aW5nCmJ1c2luZXNzLWNyaXRpY2FsIGFwcGxpY2F0aW9ucwpieSBjb21iaW5pbmcgdGVjaG5vbG9n eSwgcmVzZWFyY2ggYW5kIGFuYWx5dGljcy4gT25hcHNpcyBlbmFibGVzIGV2ZXJ5CnNlY3VyaXR5 IGFuZCBjb21wbGlhbmNlIHRlYW0gYW4KYWRhcHRpdmUgYXBwcm9hY2ggdG8gZm9jdXMgb24gdGhl IGZhY3RvcnMgdGhhdCBtYXR0ZXIgbW9zdCB0byB0aGVpcgpidXNpbmVzc+KAkyBjcml0aWNhbCBh cHBsaWNhdGlvbnMKdGhhdCBob3VzZSB2aXRhbCBkYXRhIGFuZCBydW4gYnVzaW5lc3MgcHJvY2Vz c2VzIGluY2x1ZGluZyBTQVAgQnVzaW5lc3MKU3VpdGUsIFNBUCBIQU5BIGFuZCBTQVAgTW9iaWxl IGRlcGxveW1lbnRzLgoKLS0tLS1CRUdJTiBQR1AgU0lHTkFUVVJFLS0tLS0KVmVyc2lvbjogR251 UEcgdjIuMC4yMiAoR05VL0xpbnV4KQpDb21tZW50OiBPbmFwc2lzIFJlc2VhcmNoIFRlYW0KCmlF WUVBUkVDQUFZRkFsWUJYb2NBQ2drUXozaTZXTlZCY0RXelFBQ2ZYTlRrckduak53M1ZBUzlOTWxI ZnJFOHUKWkNZQW4zS2dzTFM0aWxSNVl5OWE1dEdqM2tob3RXbUUKPXR1T3kKLS0tLS1FTkQgUEdQ IFNJR05BVFVSRS0tLS0tCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fXwpTZW50IHRocm91Z2ggdGhlIEZ1bGwgRGlzY2xvc3VyZSBtYWlsaW5nIGxpc3QKaHR0 cHM6Ly9ubWFwLm9yZy9tYWlsbWFuL2xpc3RpbmZvL2Z1bGxkaXNjbG9zdXJlCldlYiBBcmNoaXZl cyAmIFJTUzogaHR0cDovL3NlY2xpc3RzLm9yZy9mdWxsZGlzY2xvc3VyZS8=