[ERPSCAN-15-031] SAP MII – Encryption Downgrade vulnerability
ERPScan inc <[email protected]> Fri, 12 Feb 2016 20:51:04 +0300
| Newsgroups | gmane.comp.security.fulldisclosure,gmane.comp.security.penetration,gmane.comp.security.news.securitytracker,gmane.comp.security.bugtraq |
|---|---|
| Message-ID | <CANHWe92s0KtwDmZbDTxZtMMp_5OZ2+5yy7yBJeq+2XytYHMi+g@mail.gmail.com> |
QXBwbGljYXRpb246ICAgICAgICAgICAgICAgIFNBUCBNSUkKVmVyc2lvbnMgQWZmZWN0ZWQ6ICAg ICBTQVAgTUlJIDEyLjIsIDE0LjAsIDE1LjAKVmVuZG9yIFVSTDogICAgICAgICAgICAgIGh0dHA6 Ly9TQVAuY29tCkJ1Z3M6ICAgICAgICAgICAgICAgICAgICAgICAgIEF1dGhlbnRpY2F0aW9uIGJ5 cGFzcwpTZW5kOiAgICAgICAgICAgICAgICAgICAgICAgICAwNS4wOS4yMDE1ClJlcG9ydGVkOiAg ICAgICAgICAgICAgICAgICAwNS4wOS4yMDE1ClZlbmRvciByZXNwb25zZTogICAgICAwNi4wOS4y MDE1CkRhdGUgb2YgUHVibGljIEFkdmlzb3J5OiAyMC4xMS4yMDE1ClJlZmVyZW5jZTogICAgICAg ICAgICAgICAgU0FQIFNlY3VyaXR5IE5vdGUgMjI0MDI3NApBdXRob3I6ICAgICAgICAgICAgICAg ICAgICAgICBNYXRoaWV1IEdlbGkgKEVSUFNjYW4pCgoKCkRlc2NyaXB0aW9uCgoKMS4gQURWSVNP UlkgSU5GT1JNQVRJT04KVGl0bGU6IFNBUCBNSUkKQWR2aXNvcnkgSUQ6IFtFUlBTQ0FOLTE1LTAz MV0KUmlzazogTWVkaXVtCkFkdmlzb3J5IFVSTDogaHR0cHM6Ly9lcnBzY2FuLmNvbS9hZHZpc29y aWVzL2VycHNjYW4tMTUtMDMxLXVzaW5nLWJhc2U2NC1hbmQtZGVzLWluLXNhcC1taWkvCkRhdGUg cHVibGlzaGVkOiAyMC4xMS4yMDE1ClZlbmRvcnMgY29udGFjdGVkOiBTQVAKCjIuIFZVTE5FUkFC SUxJVFkgSU5GT1JNQVRJT04KQ2xhc3M6IENyeXB0b2dyYXBoaWMgaXNzdWVzCkltcGFjdDogcmVh ZGluZyBwcml2YXRlIGluZm9ybWF0aW9uClJlbW90ZWx5IEV4cGxvaXRhYmxlOiBZZXMKTG9jYWxs eSBFeHBsb2l0YWJsZTogTm8KQ1ZFIE5hbWU6IENWRS0yMDE1LTgzMjkKCkNWU1MgSW5mb3JtYXRp b24KQ1ZTUyBCYXNlIFNjb3JlOiAgMi4xIC8gMTAKQ1ZTUyBCYXNlIFZlY3RvcjoKQVYgOiBBY2Nl c3MgVmVjdG9yIChSZWxhdGVkIGV4cGxvaXQgcmFuZ2UpICAgICAgICAgICAgIE5ldHdvcmsgKE4p CkFDIDogQWNjZXNzIENvbXBsZXhpdHkgKFJlcXVpcmVkIGF0dGFjayBjb21wbGV4aXR5KSAgICBI aWdoIChIKQpBdSA6IEF1dGhlbnRpY2F0aW9uIChMZXZlbCBvZiBhdXRoZW50aWNhdGlvbiBuZWVk ZWQgdG8gZXhwbG9pdCkgU2luZ2xlIChTKQpDIDogSW1wYWN0IHRvIENvbmZpZGVudGlhbGl0eSBQ YXJ0aWFsIChQKQpJICA6IEltcGFjdCB0byBJbnRlZ3JpdHkgTm9uZSAoTikKQSA6IEltcGFjdCB0 byBBdmFpbGFiaWxpdHkgTm9uZSAoTikKCgoKCjMuIFZVTE5FUkFCSUxJVFkgREVTQ1JJUFRJT04K U0FQIE1JSSBhbGxvd3MgQmFzZTY0IGFuZCBERVMgYXMgYW4gZW5jcnlwdGlvbiBhbGdvcml0aG0u CgoKCjQuIFZVTE5FUkFCTEUgUEFDS0FHRVMKU0FQIE1JSSAxMi4yLCAxNC4wLCAxNS4wCk90aGVy IHZlcnNpb25zIGFyZSBwcm9iYWJseSBhZmZlY3RlZCB0b28sIGJ1dCB0aGV5IHdlcmUgbm90IGNo ZWNrZWQuCgo1LiBTT0xVVElPTlMgQU5EIFdPUktBUk9VTkRTClRvIGNvcnJlY3QgdGhpcyB2dWxu ZXJhYmlsaXR5LCBpbnN0YWxsIFNBUCBTZWN1cml0eSBOb3RlIDIyNDAyNzQKCgo2LiBBVVRIT1IK TWF0aGlldSBHZWxpIChFUlBTY2FuKQoKCjcuIFRFQ0hOSUNBTCBERVNDUklQVElPTgpTQVAgTUlJ IGFsbG93cyBCYXNlNjQgYW5kIERFUyBhbGdvcml0aG0gc2VsZWN0aW9uIGF0IGVuY3J5cHRpb24K Y29uZmlndXJhdGlvbiBhbmQgZXhwb3J0IGNvbmZpZ3VyYXRpb24gc2NyZWVucy4KCgo4LiBSRVBP UlQgVElNRUxJTkUKU2VuZDogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIDA1 LjA5LjIwMTUKUmVwb3J0ZWQ6IDA1LjA5LjIwMTUKVmVuZG9yIHJlc3BvbnNlOiAwNi4wOS4yMDE1 CkRhdGUgb2YgUHVibGljIEFkdmlzb3J5OiAyMC4xMS4yMDE1CgoKCjkuIFJFRkVSRU5DRVMKaHR0 cHM6Ly9lcnBzY2FuLmNvbS9hZHZpc29yaWVzL2VycHNjYW4tMTUtMDMxLXVzaW5nLWJhc2U2NC1h bmQtZGVzLWluLXNhcC1taWkvCgoxMC4gQUJPVVQgRVJQU2NhbiBSZXNlYXJjaApUaGUgY29tcGFu eeKAmXMgZXhwZXJ0aXNlIGlzIGJhc2VkIG9uIHRoZSByZXNlYXJjaCBzdWJkaXZpc2lvbiBvZgpF UlBTY2FuLCB3aGljaCBpcyBlbmdhZ2VkIGluIHZ1bG5lcmFiaWxpdHkgcmVzZWFyY2ggYW5kIGFu YWx5c2lzIG9mCmNyaXRpY2FsIGVudGVycHJpc2UgYXBwbGljYXRpb25zLiBJdCBoYXMgYWNoaWV2 ZWQgbXVsdGlwbGUKYWNrbm93bGVkZ21lbnRzIGZyb20gdGhlIGxhcmdlc3Qgc29mdHdhcmUgdmVu ZG9ycyBsaWtlIFNBUCwgT3JhY2xlLApNaWNyb3NvZnQsIElCTSwgVk13YXJlLCBIUCBmb3IgZGlz Y292ZXJpbmcgbW9yZSB0aGFuIDQwMAp2dWxuZXJhYmlsaXRpZXMgaW4gdGhlaXIgc29sdXRpb25z ICgyMDAgb2YgdGhlbSBqdXN0IGluIFNBUCEpLgpFUlBTY2FuIHJlc2VhcmNoZXJzIGFyZSBwcm91 ZCB0byBoYXZlIGV4cG9zZWQgbmV3IHR5cGVzIG9mCnZ1bG5lcmFiaWxpdGllcyAoVE9QIDEwIFdl YiBIYWNraW5nIFRlY2huaXF1ZXMgMjAxMikgYW5kIHRvIGJlCm5vbWluYXRlZCBmb3IgdGhlIGJl c3Qgc2VydmVyLXNpZGUgdnVsbmVyYWJpbGl0eSBhdCBCbGFja0hhdCAyMDEzLgpFUlBTY2FuIGV4 cGVydHMgaGF2ZSBiZWVuIGludml0ZWQgdG8gc3BlYWssIHByZXNlbnQsIGFuZCB0cmFpbiBhdCA2 MCsKcHJpbWUgaW50ZXJuYXRpb25hbCBzZWN1cml0eSBjb25mZXJlbmNlcyBpbiAyNSsgY291bnRy aWVzIGFjcm9zcyB0aGUKY29udGluZW50cy4gVGhlc2UgaW5jbHVkZSBCbGFja0hhdCwgUlNBLCBI SVRCLCBhbmQgcHJpdmF0ZSBTQVAKdHJhaW5pbmdzIGluIHNldmVyYWwgRm9ydHVuZSAyMDAwIGNv bXBhbmllcy4KRVJQU2NhbiByZXNlYXJjaGVycyBsZWFkIHRoZSBwcm9qZWN0IEVBUy1TRUMsIHdo aWNoIGlzIGZvY3VzZWQgb24KZW50ZXJwcmlzZSBhcHBsaWNhdGlvbiBzZWN1cml0eSByZXNlYXJj aCBhbmQgYXdhcmVuZXNzLiBUaGV5IGhhdmUKcHVibGlzaGVkIDMgZXhoYXVzdGl2ZSBhbm51YWwg YXdhcmQtd2lubmluZyBzdXJ2ZXlzIGFib3V0IFNBUApzZWN1cml0eS4KRVJQU2NhbiBleHBlcnRz IGhhdmUgYmVlbiBpbnRlcnZpZXdlZCBieSBsZWFkaW5nIG1lZGlhIHJlc291cmNlcyBhbmQKZmVh dHVyZWQgaW4gc3BlY2lhbGl6ZWQgaW5mby1zZWMgcHVibGljYXRpb25zIHdvcmxkd2lkZS4gVGhl c2UgaW5jbHVkZQpSZXV0ZXJzLCBZYWhvbywgU0MgTWFnYXppbmUsIFRoZSBSZWdpc3RlciwgQ0lP LCBQQyBXb3JsZCwgRGFya1JlYWRpbmcsCkhlaXNlLCBhbmQgQ2hpbmFieXRlLCB0byBuYW1lIGEg ZmV3LgpXZSBoYXZlIGhpZ2hseSBxdWFsaWZpZWQgZXhwZXJ0cyBpbiBzdGFmZiB3aXRoIGV4cGVy aWVuY2UgaW4gbWFueQpkaWZmZXJlbnQgZmllbGRzIG9mIHNlY3VyaXR5LCBmcm9tIHdlYiBhcHBs aWNhdGlvbnMgYW5kCm1vYmlsZS9lbWJlZGRlZCB0byByZXZlcnNlIGVuZ2luZWVyaW5nIGFuZCBJ Q1MvU0NBREEgc3lzdGVtcywKYWNjdW11bGF0aW5nIHRoZWlyIGV4cGVyaWVuY2UgdG8gY29uZHVj dCB0aGUgYmVzdCBTQVAgc2VjdXJpdHkKcmVzZWFyY2guCgoKMTEuIEFCT1VUIEVSUFNjYW4KRVJQ U2NhbiBpcyB0aGUgbW9zdCByZXNwZWN0ZWQgYW5kIGNyZWRpYmxlIEJ1c2luZXNzIEFwcGxpY2F0 aW9uClNlY3VyaXR5IHByb3ZpZGVyLiBGb3VuZGVkIGluIDIwMTAsIHRoZSBjb21wYW55IG9wZXJh dGVzIGdsb2JhbGx5IGFuZAplbmFibGVzIGxhcmdlIE9pbCBhbmQgR2FzLCBGaW5hbmNpYWwgYW5k IFJldGFpbCBvcmdhbml6YXRpb25zIHRvCnNlY3VyZSB0aGVpciBtaXNzaW9uLWNyaXRpY2FsIHBy b2Nlc3Nlcy4gTmFtZWQgYXMgYW4g4oCYRW1lcmdpbmcgVmVuZG9y4oCZCmluIFNlY3VyaXR5IGJ5 IENSTiwgbGlzdGVkIGFtb25nIOKAnFRPUCAxMDAgU0FQIFNvbHV0aW9uIHByb3ZpZGVyc+KAnSBh bmQKZGlzdGluZ3Vpc2hlZCBieSAzMCsgb3RoZXIgYXdhcmRzLCBFUlBTY2FuIGlzIHRoZSBsZWFk aW5nIFNBUCBTRQpwYXJ0bmVyIGluIGRpc2NvdmVyaW5nIGFuZCByZXNvbHZpbmcgc2VjdXJpdHkg dnVsbmVyYWJpbGl0aWVzLiBFUlBTY2FuCmNvbnN1bHRhbnRzIHdvcmsgd2l0aCBTQVAgU0UgaW4g V2FsbGRvcmYgdG8gYXNzaXN0IGluIGltcHJvdmluZyB0aGUKc2VjdXJpdHkgb2YgdGhlaXIgbGF0 ZXN0IHNvbHV0aW9ucy4KRVJQU2NhbuKAmXMgcHJpbWFyeSBtaXNzaW9uIGlzIHRvIGNsb3NlIHRo ZSBnYXAgYmV0d2VlbiB0ZWNobmljYWwgYW5kCmJ1c2luZXNzIHNlY3VyaXR5LCBhbmQgcHJvdmlk ZSBzb2x1dGlvbnMgdG8gZXZhbHVhdGUgYW5kIHNlY3VyZSBTQVAKYW5kIE9yYWNsZSBFUlAgc3lz dGVtcyBhbmQgYnVzaW5lc3MtY3JpdGljYWwgYXBwbGljYXRpb25zIGZyb20gYm90aCwKY3liZXIt YXR0YWNrcyBhcyB3ZWxsIGFzIGludGVybmFsIGZyYXVkLiBVc3VhbGx5IG91ciBjbGllbnRzIGFy ZSBsYXJnZQplbnRlcnByaXNlcywgRm9ydHVuZSAyMDAwIGNvbXBhbmllcyBhbmQgbWFuYWdlZCBz ZXJ2aWNlIHByb3ZpZGVycwp3aG9zZSByZXF1aXJlbWVudHMgYXJlIHRvIGFjdGl2ZWx5IG1vbml0 b3IgYW5kIG1hbmFnZSBzZWN1cml0eSBvZiB2YXN0ClNBUCBsYW5kc2NhcGVzIG9uIGEgZ2xvYmFs IHNjYWxlLgpXZSDigJhmb2xsb3cgdGhlIHN1buKAmSBhbmQgZnVuY3Rpb24gaW4gdHdvIGh1YnMs IGxvY2F0ZWQgaW4gdGhlIFBhbG8gQWx0bwphbmQgQW1zdGVyZGFtIHRvIHByb3ZpZGUgdGhyZWF0 IGludGVsbGlnZW5jZSBzZXJ2aWNlcywgYWdpbGUgc3VwcG9ydAphbmQgb3BlcmF0ZSBsb2NhbCBv ZmZpY2VzIGFuZCBwYXJ0bmVyIG5ldHdvcmsgc3Bhbm5pbmcgMjArIGNvdW50cmllcwphcm91bmQg dGhlIGdsb2JlLgoKCgpBZHJlc3MgVVNBOiAyMjggSGFtaWx0b24gQXZlbnVlLCBGbC4gMywgUGFs byBBbHRvLCBDQS4gOTQzMDEKUGhvbmU6IDY1MC43OTguNTI1NQpUd2l0dGVyOiBAZXJwc2NhbgpT Y29vcC1pdDogQnVzaW5lc3MgQXBwbGljYXRpb24gU2VjdXJpdHkKCl9fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fClNlbnQgdGhyb3VnaCB0aGUgRnVsbCBEaXNj bG9zdXJlIG1haWxpbmcgbGlzdApodHRwczovL25tYXAub3JnL21haWxtYW4vbGlzdGluZm8vZnVs bGRpc2Nsb3N1cmUKV2ViIEFyY2hpdmVzICYgUlNTOiBodHRwOi8vc2VjbGlzdHMub3JnL2Z1bGxk aXNjbG9zdXJlLw==