[ERPSCAN-15-032] SAP PCo agent – DoS v ulnerability
ERPScan inc <[email protected]> Fri, 12 Feb 2016 20:52:47 +0300
| Newsgroups | gmane.comp.security.fulldisclosure,gmane.comp.security.penetration,gmane.comp.security.news.securitytracker,gmane.comp.security.bugtraq |
|---|---|
| Message-ID | <CANHWe91bPSprmNCw1Onyk+=nasiZ5LEWdEf0awRPPDf4jXrUPQ@mail.gmail.com> |
QXBwbGljYXRpb246IFNBUCBQQ28KVmVyc2lvbnMgQWZmZWN0ZWQ6IFNBUCBQQ28gMi4yLCAyLjMs IDE1LjAsIGFuZCAxNS4xClZlbmRvciBVUkw6IGh0dHA6Ly9TQVAuY29tCkJ1Z3M6IERvUwpTZW5k OiAwNS4wOS4yMDE1ClJlcG9ydGVkOiAwNS4wOS4yMDE1ClZlbmRvciByZXNwb25zZTogMDYuMDku MjAxNQpEYXRlIG9mIFB1YmxpYyBBZHZpc29yeTogMjAuMTEuMjAxNQpSZWZlcmVuY2U6IFNBUCBT ZWN1cml0eSBOb3RlIDIyMzg2MTkKQXV0aG9yOiAgTWF0aGlldSBHZWxpIChFUlBTY2FuKQoKCkRl c2NyaXB0aW9uCgoKMS4gQURWSVNPUlkgSU5GT1JNQVRJT04KVGl0bGU6IFNBUCBQQ28KQWR2aXNv cnkgSUQ6IFtFUlBTQ0FOLTE1LTAzMl0KUmlzazogaGlnaApBZHZpc29yeSBVUkw6IGh0dHBzOi8v ZXJwc2Nhbi5jb20vYWR2aXNvcmllcy9lcnBzY2FuLTE1LTAzMi1zYXAtcGNvLWFnZW50LWRvcy12 dWxuZXJhYmlsaXR5LwpEYXRlIHB1Ymxpc2hlZDogMjAuMTEuMjAxNQpWZW5kb3JzIGNvbnRhY3Rl ZDogU0FQCgoyLiBWVUxORVJBQklMSVRZIElORk9STUFUSU9OCkNsYXNzOiBEZW5pYWwgb2Ygc2Vy dmljZQpJbXBhY3Q6IERpc3J1cHQgb3BlcmF0aW9uYWwgc3RhdHVzClJlbW90ZWx5IEV4cGxvaXRh YmxlOiBZZXMKTG9jYWxseSBFeHBsb2l0YWJsZTogWWVzCkNWRSBOYW1lOiBDVkUtMjAxNS04MzMw CgoKQ1ZTUyBJbmZvcm1hdGlvbgpDVlNTIEJhc2UgU2NvcmU6ICA3LjEgLyAxMApDVlNTIEJhc2Ug VmVjdG9yOgpBViA6IEFjY2VzcyBWZWN0b3IgKFJlbGF0ZWQgZXhwbG9pdCByYW5nZSkgTmV0d29y ayAoTikKQUMgOiBBY2Nlc3MgQ29tcGxleGl0eSAoUmVxdWlyZWQgYXR0YWNrIGNvbXBsZXhpdHkp IE1lZGl1bSAoTSkKQXUgOiBBdXRoZW50aWNhdGlvbiAoTGV2ZWwgb2YgYXV0aGVudGljYXRpb24g bmVlZGVkIHRvIGV4cGxvaXQpIE5vbmUgKE4pCkMgOiBJbXBhY3QgdG8gQ29uZmlkZW50aWFsaXR5 IE5vbmUgKE4pCkkgIDogSW1wYWN0IHRvIEludGVncml0eSBOb25lIChOKQpBIDogSW1wYWN0IHRv IEF2YWlsYWJpbGl0eSBDb21wbGV0ZSAoQykKCjMuIFZVTE5FUkFCSUxJVFkgREVTQ1JJUFRJT04K CkFuIGF0dGFja2VyIGNhbiBjcmFzaCB0aGUgUENvIGFnZW50IGJ5IGZvcmdpbmcgeE1JSSByZXF1 ZXN0cyB0byB0aGUgVENQIHBvcnQuCgoKNC4gVlVMTkVSQUJMRSBQQUNLQUdFUwoKU0FQIFBDbyBh Z2VudCAyLjIsIDIuMywgMTUuMCBhbmQgMTUuMQpPdGhlciB2ZXJzaW9ucyBhcmUgcHJvYmFibHkg YWZmZWN0ZWQgdG9vLCBidXQgdGhleSB3ZXJlIG5vdCBjaGVja2VkLgoKNS4gU09MVVRJT05TIEFO RCBXT1JLQVJPVU5EUwoKVG8gY29ycmVjdCB0aGlzIHZ1bG5lcmFiaWxpdHksIGluc3RhbGwgU0FQ IFNlY3VyaXR5IE5vdGUgMjIzODYxOQoKCjYuIEFVVEhPUgoKTWF0aGlldSBHZWxpIChFUlBTY2Fu KQoKCjcuIFRFQ0hOSUNBTCBERVNDUklQVElPTgoKV2hlbiBzZW5kaW5nIHNwZWNpYWwgZm9yZ2Vk IHF1ZXJpZXMgdG8gdGhlIFNBUCBQY28gQWdlbnQgKGF2YWlsYWJsZSBpbgpxdWVyeSBtb2RlKSwg eW91IGNhbiBjcmFzaCB0aGUgYWdlbnQgYW5kIGRpc3J1cHQgYSBQQ28gb3BlcmF0aW9uLgoKCjgu IFJFUE9SVCBUSU1FTElORQoKU2VuZDogICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg ICAgIDA1LjA5LjIwMTUKUmVwb3J0ZWQ6IDA1LjA5LjIwMTUKVmVuZG9yIHJlc3BvbnNlOiAwNi4w OS4yMDE1CkRhdGUgb2YgUHVibGljIEFkdmlzb3J5OiAyMC4xMS4yMDE1CgoKCjkuIFJFRkVSRU5D RVMKCmh0dHBzOi8vZXJwc2Nhbi5jb20vYWR2aXNvcmllcy9lcnBzY2FuLTE1LTAzMi1zYXAtcGNv LWFnZW50LWRvcy12dWxuZXJhYmlsaXR5LwoKMTAuIEFCT1VUIEVSUFNjYW4gUmVzZWFyY2gKClRo ZSBjb21wYW554oCZcyBleHBlcnRpc2UgaXMgYmFzZWQgb24gdGhlIHJlc2VhcmNoIHN1YmRpdmlz aW9uIG9mCkVSUFNjYW4sIHdoaWNoIGlzIGVuZ2FnZWQgaW4gdnVsbmVyYWJpbGl0eSByZXNlYXJj aCBhbmQgYW5hbHlzaXMgb2YKY3JpdGljYWwgZW50ZXJwcmlzZSBhcHBsaWNhdGlvbnMuIEl0IGhh cyBhY2hpZXZlZCBtdWx0aXBsZQphY2tub3dsZWRnbWVudHMgZnJvbSB0aGUgbGFyZ2VzdCBzb2Z0 d2FyZSB2ZW5kb3JzIGxpa2UgU0FQLCBPcmFjbGUsCk1pY3Jvc29mdCwgSUJNLCBWTXdhcmUsIEhQ IGZvciBkaXNjb3ZlcmluZyBtb3JlIHRoYW4gNDAwCnZ1bG5lcmFiaWxpdGllcyBpbiB0aGVpciBz b2x1dGlvbnMgKDIwMCBvZiB0aGVtIGp1c3QgaW4gU0FQISkuCkVSUFNjYW4gcmVzZWFyY2hlcnMg YXJlIHByb3VkIHRvIGhhdmUgZXhwb3NlZCBuZXcgdHlwZXMgb2YKdnVsbmVyYWJpbGl0aWVzIChU T1AgMTAgV2ViIEhhY2tpbmcgVGVjaG5pcXVlcyAyMDEyKSBhbmQgdG8gYmUKbm9taW5hdGVkIGZv ciB0aGUgYmVzdCBzZXJ2ZXItc2lkZSB2dWxuZXJhYmlsaXR5IGF0IEJsYWNrSGF0IDIwMTMuCkVS UFNjYW4gZXhwZXJ0cyBoYXZlIGJlZW4gaW52aXRlZCB0byBzcGVhaywgcHJlc2VudCwgYW5kIHRy YWluIGF0IDYwKwpwcmltZSBpbnRlcm5hdGlvbmFsIHNlY3VyaXR5IGNvbmZlcmVuY2VzIGluIDI1 KyBjb3VudHJpZXMgYWNyb3NzIHRoZQpjb250aW5lbnRzLiBUaGVzZSBpbmNsdWRlIEJsYWNrSGF0 LCBSU0EsIEhJVEIsIGFuZCBwcml2YXRlIFNBUAp0cmFpbmluZ3MgaW4gc2V2ZXJhbCBGb3J0dW5l IDIwMDAgY29tcGFuaWVzLgpFUlBTY2FuIHJlc2VhcmNoZXJzIGxlYWQgdGhlIHByb2plY3QgRUFT LVNFQywgd2hpY2ggaXMgZm9jdXNlZCBvbgplbnRlcnByaXNlIGFwcGxpY2F0aW9uIHNlY3VyaXR5 IHJlc2VhcmNoIGFuZCBhd2FyZW5lc3MuIFRoZXkgaGF2ZQpwdWJsaXNoZWQgMyBleGhhdXN0aXZl IGFubnVhbCBhd2FyZC13aW5uaW5nIHN1cnZleXMgYWJvdXQgU0FQCnNlY3VyaXR5LgpFUlBTY2Fu IGV4cGVydHMgaGF2ZSBiZWVuIGludGVydmlld2VkIGJ5IGxlYWRpbmcgbWVkaWEgcmVzb3VyY2Vz IGFuZApmZWF0dXJlZCBpbiBzcGVjaWFsaXplZCBpbmZvLXNlYyBwdWJsaWNhdGlvbnMgd29ybGR3 aWRlLiBUaGVzZSBpbmNsdWRlClJldXRlcnMsIFlhaG9vLCBTQyBNYWdhemluZSwgVGhlIFJlZ2lz dGVyLCBDSU8sIFBDIFdvcmxkLCBEYXJrUmVhZGluZywKSGVpc2UsIGFuZCBDaGluYWJ5dGUsIHRv IG5hbWUgYSBmZXcuCldlIGhhdmUgaGlnaGx5IHF1YWxpZmllZCBleHBlcnRzIGluIHN0YWZmIHdp dGggZXhwZXJpZW5jZSBpbiBtYW55CmRpZmZlcmVudCBmaWVsZHMgb2Ygc2VjdXJpdHksIGZyb20g d2ViIGFwcGxpY2F0aW9ucyBhbmQKbW9iaWxlL2VtYmVkZGVkIHRvIHJldmVyc2UgZW5naW5lZXJp bmcgYW5kIElDUy9TQ0FEQSBzeXN0ZW1zLAphY2N1bXVsYXRpbmcgdGhlaXIgZXhwZXJpZW5jZSB0 byBjb25kdWN0IHRoZSBiZXN0IFNBUCBzZWN1cml0eQpyZXNlYXJjaC4KCgoxMS4gQUJPVVQgRVJQ U2NhbgoKRVJQU2NhbiBpcyB0aGUgbW9zdCByZXNwZWN0ZWQgYW5kIGNyZWRpYmxlIEJ1c2luZXNz IEFwcGxpY2F0aW9uClNlY3VyaXR5IHByb3ZpZGVyLiBGb3VuZGVkIGluIDIwMTAsIHRoZSBjb21w YW55IG9wZXJhdGVzIGdsb2JhbGx5IGFuZAplbmFibGVzIGxhcmdlIE9pbCBhbmQgR2FzLCBGaW5h bmNpYWwgYW5kIFJldGFpbCBvcmdhbml6YXRpb25zIHRvCnNlY3VyZSB0aGVpciBtaXNzaW9uLWNy aXRpY2FsIHByb2Nlc3Nlcy4gTmFtZWQgYXMgYW4g4oCYRW1lcmdpbmcgVmVuZG9y4oCZCmluIFNl Y3VyaXR5IGJ5IENSTiwgbGlzdGVkIGFtb25nIOKAnFRPUCAxMDAgU0FQIFNvbHV0aW9uIHByb3Zp ZGVyc+KAnSBhbmQKZGlzdGluZ3Vpc2hlZCBieSAzMCsgb3RoZXIgYXdhcmRzLCBFUlBTY2FuIGlz IHRoZSBsZWFkaW5nIFNBUCBTRQpwYXJ0bmVyIGluIGRpc2NvdmVyaW5nIGFuZCByZXNvbHZpbmcg c2VjdXJpdHkgdnVsbmVyYWJpbGl0aWVzLiBFUlBTY2FuCmNvbnN1bHRhbnRzIHdvcmsgd2l0aCBT QVAgU0UgaW4gV2FsbGRvcmYgdG8gYXNzaXN0IGluIGltcHJvdmluZyB0aGUKc2VjdXJpdHkgb2Yg dGhlaXIgbGF0ZXN0IHNvbHV0aW9ucy4KRVJQU2NhbuKAmXMgcHJpbWFyeSBtaXNzaW9uIGlzIHRv IGNsb3NlIHRoZSBnYXAgYmV0d2VlbiB0ZWNobmljYWwgYW5kCmJ1c2luZXNzIHNlY3VyaXR5LCBh bmQgcHJvdmlkZSBzb2x1dGlvbnMgdG8gZXZhbHVhdGUgYW5kIHNlY3VyZSBTQVAKYW5kIE9yYWNs ZSBFUlAgc3lzdGVtcyBhbmQgYnVzaW5lc3MtY3JpdGljYWwgYXBwbGljYXRpb25zIGZyb20gYm90 aCwKY3liZXItYXR0YWNrcyBhcyB3ZWxsIGFzIGludGVybmFsIGZyYXVkLiBVc3VhbGx5IG91ciBj bGllbnRzIGFyZSBsYXJnZQplbnRlcnByaXNlcywgRm9ydHVuZSAyMDAwIGNvbXBhbmllcyBhbmQg bWFuYWdlZCBzZXJ2aWNlIHByb3ZpZGVycwp3aG9zZSByZXF1aXJlbWVudHMgYXJlIHRvIGFjdGl2 ZWx5IG1vbml0b3IgYW5kIG1hbmFnZSBzZWN1cml0eSBvZiB2YXN0ClNBUCBsYW5kc2NhcGVzIG9u IGEgZ2xvYmFsIHNjYWxlLgpXZSDigJhmb2xsb3cgdGhlIHN1buKAmSBhbmQgZnVuY3Rpb24gaW4g dHdvIGh1YnMsIGxvY2F0ZWQgaW4gdGhlIFBhbG8gQWx0bwphbmQgQW1zdGVyZGFtIHRvIHByb3Zp ZGUgdGhyZWF0IGludGVsbGlnZW5jZSBzZXJ2aWNlcywgYWdpbGUgc3VwcG9ydAphbmQgb3BlcmF0 ZSBsb2NhbCBvZmZpY2VzIGFuZCBwYXJ0bmVyIG5ldHdvcmsgc3Bhbm5pbmcgMjArIGNvdW50cmll cwphcm91bmQgdGhlIGdsb2JlLgoKCgpBZHJlc3MgVVNBOiAyMjggSGFtaWx0b24gQXZlbnVlLCBG bC4gMywgUGFsbyBBbHRvLCBDQS4gOTQzMDEKUGhvbmU6IDY1MC43OTguNTI1NQpUd2l0dGVyOiBA ZXJwc2NhbgpTY29vcC1pdDogQnVzaW5lc3MgQXBwbGljYXRpb24gU2VjdXJpdHkKCl9fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fClNlbnQgdGhyb3VnaCB0aGUg RnVsbCBEaXNjbG9zdXJlIG1haWxpbmcgbGlzdApodHRwczovL25tYXAub3JnL21haWxtYW4vbGlz dGluZm8vZnVsbGRpc2Nsb3N1cmUKV2ViIEFyY2hpdmVzICYgUlNTOiBodHRwOi8vc2VjbGlzdHMu b3JnL2Z1bGxkaXNjbG9zdXJlLw==