Re: [ERPSCAN-16-005] SAP HANA hdbxsengine JSO N – DoS vulnerability
Mahmut Firuz Dumlupinar - Vendor <[email protected]> Wed, 27 Apr 2016 19:33:44 +0000
| Newsgroups | gmane.comp.security.bugtraq,gmane.comp.security.fulldisclosure,gmane.comp.security.penetration |
|---|---|
| Message-ID | <[email protected]> |
DQoNCg0KDQoNCk9uIDQvMTkvMTYsIDM6MTkgQU0sICJFUlBTY2FuIGluYyIgPGVycHNjYW4ub25s aW5lQGdtYWlsLmNvbT4gd3JvdGU6DQoNCj5BcHBsaWNhdGlvbjogU0FQIEhBTkENCj5WZXJzaW9u cyBBZmZlY3RlZDogU0FQIEhBTkENCj5WZW5kb3IgVVJMOiBodHRwOi8vU0FQLmNvbQ0KPkJ1Z3M6 IERvUw0KPlNlbnQ6ICAyOC4wOS4yMDE1DQo+UmVwb3J0ZWQ6IDI4LjA5LjIwMTUNCj5WZW5kb3Ig cmVzcG9uc2U6IDI5LjA5LjIwMTUNCj5EYXRlIG9mIFB1YmxpYyBBZHZpc29yeTogMTIuMDEuMjAx Ng0KPlJlZmVyZW5jZTogU0FQIFNlY3VyaXR5IE5vdGUgMjI0MTk3OA0KPkF1dGhvcjogICBNYXRo aWV1IEdlbGkgIChFUlBTY2FuKQ0KPg0KPkRlc2NyaXB0aW9uDQo+DQo+DQo+MS4gQURWSVNPUlkg SU5GT1JNQVRJT04NCj4NCj5UaXRsZTogU0FQIE5ldFdlYXZlciBKMkVFIEVuZ2luZSA3LjQwDQo+ QWR2aXNvcnkgSUQ6IFtFUlBTQ0FOLTE2LTAwNV0NCj5SaXNrOiBNZWRpdW0NCj5BZHZpc29yeSBV Ukw6IGh0dHA6Ly9lcnBzY2FuLmNvbS9hZHZpc29yaWVzL2VycHNjYW4tMTYtMDA1LXNhcC1oYW5h LWhkYnhzZW5naW5lLWpzb24tZG9zLw0KPkRhdGUgcHVibGlzaGVkOiAxMi4wMS4yMDE2DQo+VmVu ZG9ycyBjb250YWN0ZWQ6IFNBUA0KPg0KPjIuIFZVTE5FUkFCSUxJVFkgSU5GT1JNQVRJT04NCj5D bGFzczogRG9TDQo+SW1wYWN0OiBSZXNvdXJjZSBjb25zdW1wdGlvbg0KPlJlbW90ZWx5IEV4cGxv aXRhYmxlOiBZZXMNCj5Mb2NhbGx5IEV4cGxvaXRhYmxlOiBObw0KPg0KPkNWU1MgSW5mb3JtYXRp b24NCj5DVlNTIEJhc2UgU2NvcmU6ICA1LjAgLyAxMA0KPkNWU1MgQmFzZSBWZWN0b3I6DQo+QVYg OiBBY2Nlc3MgVmVjdG9yIChSZWxhdGVkIGV4cGxvaXQgcmFuZ2UpIE5ldHdvcmsgKE4pDQo+QUMg OiBBY2Nlc3MgQ29tcGxleGl0eSAoUmVxdWlyZWQgYXR0YWNrIGNvbXBsZXhpdHkpIExvdyAoTCkN Cj5BdSA6IEF1dGhlbnRpY2F0aW9uIChMZXZlbCBvZiBhdXRoZW50aWNhdGlvbiBuZWVkZWQgdG8g ZXhwbG9pdCkgTm9uZSAoTikNCj5DIDogSW1wYWN0IHRvIENvbmZpZGVudGlhbGl0eSBOb25lIChO KQ0KPkkgIDogSW1wYWN0IHRvIEludGVncml0eSBQYXJ0aWFsIChQKQ0KPkEgOiBJbXBhY3QgdG8g QXZhaWxhYmlsaXR5IE5vbmUgKE4pDQo+DQo+DQo+DQo+My4gVlVMTkVSQUJJTElUWSBERVNDUklQ VElPTg0KPg0KPkFub255bW91cyBhdHRhY2tlciBjYW4gdXNlIGEgc3BlY2lhbCBIVFRQIHJlcXVl c3QgdG8gcGVyZm9ybSBhIERvUw0KPmF0dGFjayBhZ2FpbnN0IEhBTkEuDQo+DQo+DQo+NC4gVlVM TkVSQUJMRSBQQUNLQUdFUw0KPg0KPlNBUCBIQU5BIHJldmlzaW9uIDEwMi4wMg0KPk90aGVyIHZl cnNpb25zIGFyZSBwcm9iYWJseSBhZmZlY3RlZCB0b28sIGJ1dCB0aGV5IHdlcmUgbm90IGNoZWNr ZWQuDQo+DQo+NS4gU09MVVRJT05TIEFORCBXT1JLQVJPVU5EUw0KPg0KPlRvIGNvcnJlY3QgdGhp cyB2dWxuZXJhYmlsaXR5LCBpbnN0YWxsIFNBUCBTZWN1cml0eSBOb3RlIDIyNDE5NzgNCj4NCj4N Cj42LiBBVVRIT1INCj4NCj5NYXRoaWV1IEdlbGkgIChFUlBTY2FuKQ0KPg0KPg0KPjcuIFRFQ0hO SUNBTCBERVNDUklQVElPTg0KPg0KPkFuIGF0dGFja2VyIGNhbiB1c2UgYSBCdWZmZXIgT3ZlcmZs b3cgdnVsbmVyYWJpbGl0eSB0byBpbmplY3QgYQ0KPnNwZWNpYWxseSBjcmFmdGVkIGNvZGUgaW50 byB3b3JraW5nIG1lbW9yeS4gVGhlIGNvZGUgd2lsbCBiZSBleGVjdXRlZA0KPmJ5IHRoZSB2dWxu ZXJhYmxlIGFwcGxpY2F0aW9uLiBFeGVjdXRlZCBjb21tYW5kcyB3aWxsIHJ1biB3aXRoIHRoZQ0K PnNhbWUgcHJpdmlsZWdlcyBhcyB0aGUgc2VydmljZSB0aGF0IGV4ZWN1dGVkIHRoZW0uIFRoaXMg Y2FuIGxlYWQgdG8NCj50YWtpbmcgY29tcGxldGUgY29udHJvbCBvdmVyIHRoZSBhcHBsaWNhdGlv biwgZGVuaWFsIG9mIHNlcnZpY2UsDQo+Y29tbWFuZCBleGVjdXRpb24sIGFuZCBvdGhlciBhdHRh Y2tzLg0KPg0KPg0KPjguIFJFUE9SVCBUSU1FTElORQ0KPlNlbnQ6IDI4LjA5LjIwMTUNCj5SZXBv cnRlZDogMjguMDkuMjAxNQ0KPlZlbmRvciByZXNwb25zZTogMjkuMDkuMjAxNQ0KPkRhdGUgb2Yg UHVibGljIEFkdmlzb3J5OiAxMi4wMS4yMDE2DQo+DQo+DQo+OS4gUkVGRVJFTkNFUw0KPmh0dHA6 Ly9lcnBzY2FuLmNvbS9hZHZpc29yaWVzL2VycHNjYW4tMTYtMDA1LXNhcC1oYW5hLWhkYnhzZW5n aW5lLWpzb24tZG9zLw0KPg0KPjEwLiBBQk9VVCBFUlBTY2FuIFJlc2VhcmNoDQo+DQo+VGhlIGNv bXBhbnnigJlzIGV4cGVydGlzZSBpcyBiYXNlZCBvbiB0aGUgcmVzZWFyY2ggc3ViZGl2aXNpb24g b2YNCj5FUlBTY2FuLCB3aGljaCBpcyBlbmdhZ2VkIGluIHZ1bG5lcmFiaWxpdHkgcmVzZWFyY2gg YW5kIGFuYWx5c2lzIG9mDQo+Y3JpdGljYWwgZW50ZXJwcmlzZSBhcHBsaWNhdGlvbnMuIEl0IGhh cyBhY2hpZXZlZCBtdWx0aXBsZQ0KPmFja25vd2xlZGdtZW50cyBmcm9tIHRoZSBsYXJnZXN0IHNv ZnR3YXJlIHZlbmRvcnMgbGlrZSBTQVAsIE9yYWNsZSwNCj5NaWNyb3NvZnQsIElCTSwgVk13YXJl LCBIUCBmb3IgZGlzY292ZXJpbmcgbW9yZSB0aGFuIDQwMA0KPnZ1bG5lcmFiaWxpdGllcyBpbiB0 aGVpciBzb2x1dGlvbnMgKDIwMCBvZiB0aGVtIGp1c3QgaW4gU0FQISkuDQo+RVJQU2NhbiByZXNl YXJjaGVycyBhcmUgcHJvdWQgdG8gaGF2ZSBleHBvc2VkIG5ldyB0eXBlcyBvZg0KPnZ1bG5lcmFi aWxpdGllcyAoVE9QIDEwIFdlYiBIYWNraW5nIFRlY2huaXF1ZXMgMjAxMikgYW5kIHRvIGJlDQo+ bm9taW5hdGVkIGZvciB0aGUgYmVzdCBzZXJ2ZXItc2lkZSB2dWxuZXJhYmlsaXR5IGF0IEJsYWNr SGF0IDIwMTMuDQo+RVJQU2NhbiBleHBlcnRzIGhhdmUgYmVlbiBpbnZpdGVkIHRvIHNwZWFrLCBw cmVzZW50LCBhbmQgdHJhaW4gYXQgNjArDQo+cHJpbWUgaW50ZXJuYXRpb25hbCBzZWN1cml0eSBj b25mZXJlbmNlcyBpbiAyNSsgY291bnRyaWVzIGFjcm9zcyB0aGUNCj5jb250aW5lbnRzLiBUaGVz ZSBpbmNsdWRlIEJsYWNrSGF0LCBSU0EsIEhJVEIsIGFuZCBwcml2YXRlIFNBUA0KPnRyYWluaW5n cyBpbiBzZXZlcmFsIEZvcnR1bmUgMjAwMCBjb21wYW5pZXMuDQo+RVJQU2NhbiByZXNlYXJjaGVy cyBsZWFkIHRoZSBwcm9qZWN0IEVBUy1TRUMsIHdoaWNoIGlzIGZvY3VzZWQgb24NCj5lbnRlcnBy aXNlIGFwcGxpY2F0aW9uIHNlY3VyaXR5IHJlc2VhcmNoIGFuZCBhd2FyZW5lc3MuIFRoZXkgaGF2 ZQ0KPnB1Ymxpc2hlZCAzIGV4aGF1c3RpdmUgYW5udWFsIGF3YXJkLXdpbm5pbmcgc3VydmV5cyBh Ym91dCBTQVANCj5zZWN1cml0eS4NCj5FUlBTY2FuIGV4cGVydHMgaGF2ZSBiZWVuIGludGVydmll d2VkIGJ5IGxlYWRpbmcgbWVkaWEgcmVzb3VyY2VzIGFuZA0KPmZlYXR1cmVkIGluIHNwZWNpYWxp emVkIGluZm8tc2VjIHB1YmxpY2F0aW9ucyB3b3JsZHdpZGUuIFRoZXNlIGluY2x1ZGUNCj5SZXV0 ZXJzLCBZYWhvbywgU0MgTWFnYXppbmUsIFRoZSBSZWdpc3RlciwgQ0lPLCBQQyBXb3JsZCwgRGFy a1JlYWRpbmcsDQo+SGVpc2UsIGFuZCBDaGluYWJ5dGUsIHRvIG5hbWUgYSBmZXcuDQo+V2UgaGF2 ZSBoaWdobHkgcXVhbGlmaWVkIGV4cGVydHMgaW4gc3RhZmYgd2l0aCBleHBlcmllbmNlIGluIG1h bnkNCj5kaWZmZXJlbnQgZmllbGRzIG9mIHNlY3VyaXR5LCBmcm9tIHdlYiBhcHBsaWNhdGlvbnMg YW5kDQo+bW9iaWxlL2VtYmVkZGVkIHRvIHJldmVyc2UgZW5naW5lZXJpbmcgYW5kIElDUy9TQ0FE QSBzeXN0ZW1zLA0KPmFjY3VtdWxhdGluZyB0aGVpciBleHBlcmllbmNlIHRvIGNvbmR1Y3QgdGhl IGJlc3QgU0FQIHNlY3VyaXR5DQo+cmVzZWFyY2guDQo+DQo+DQo+MTEuIEFCT1VUIEVSUFNjYW4N Cj4NCj5FUlBTY2FuIGlzIHRoZSBtb3N0IHJlc3BlY3RlZCBhbmQgY3JlZGlibGUgQnVzaW5lc3Mg QXBwbGljYXRpb24NCj5TZWN1cml0eSBwcm92aWRlci4gRm91bmRlZCBpbiAyMDEwLCB0aGUgY29t cGFueSBvcGVyYXRlcyBnbG9iYWxseSBhbmQNCj5lbmFibGVzIGxhcmdlIE9pbCBhbmQgR2FzLCBG aW5hbmNpYWwgYW5kIFJldGFpbCBvcmdhbml6YXRpb25zIHRvDQo+c2VjdXJlIHRoZWlyIG1pc3Np b24tY3JpdGljYWwgcHJvY2Vzc2VzLiBOYW1lZCBhcyBhbiDigJhFbWVyZ2luZyBWZW5kb3LigJkN Cj5pbiBTZWN1cml0eSBieSBDUk4sIGxpc3RlZCBhbW9uZyDigJxUT1AgMTAwIFNBUCBTb2x1dGlv biBwcm92aWRlcnPigJ0gYW5kDQo+ZGlzdGluZ3Vpc2hlZCBieSAzMCsgb3RoZXIgYXdhcmRzLCBF UlBTY2FuIGlzIHRoZSBsZWFkaW5nIFNBUCBTRQ0KPnBhcnRuZXIgaW4gZGlzY292ZXJpbmcgYW5k IHJlc29sdmluZyBzZWN1cml0eSB2dWxuZXJhYmlsaXRpZXMuIEVSUFNjYW4NCj5jb25zdWx0YW50 cyB3b3JrIHdpdGggU0FQIFNFIGluIFdhbGxkb3JmIHRvIGFzc2lzdCBpbiBpbXByb3ZpbmcgdGhl DQo+c2VjdXJpdHkgb2YgdGhlaXIgbGF0ZXN0IHNvbHV0aW9ucy4NCj5FUlBTY2Fu4oCZcyBwcmlt YXJ5IG1pc3Npb24gaXMgdG8gY2xvc2UgdGhlIGdhcCBiZXR3ZWVuIHRlY2huaWNhbCBhbmQNCj5i dXNpbmVzcyBzZWN1cml0eSwgYW5kIHByb3ZpZGUgc29sdXRpb25zIHRvIGV2YWx1YXRlIGFuZCBz ZWN1cmUgU0FQDQo+YW5kIE9yYWNsZSBFUlAgc3lzdGVtcyBhbmQgYnVzaW5lc3MtY3JpdGljYWwg YXBwbGljYXRpb25zIGZyb20gYm90aCwNCj5jeWJlci1hdHRhY2tzIGFzIHdlbGwgYXMgaW50ZXJu YWwgZnJhdWQuIFVzdWFsbHkgb3VyIGNsaWVudHMgYXJlIGxhcmdlDQo+ZW50ZXJwcmlzZXMsIEZv cnR1bmUgMjAwMCBjb21wYW5pZXMgYW5kIG1hbmFnZWQgc2VydmljZSBwcm92aWRlcnMNCj53aG9z ZSByZXF1aXJlbWVudHMgYXJlIHRvIGFjdGl2ZWx5IG1vbml0b3IgYW5kIG1hbmFnZSBzZWN1cml0 eSBvZiB2YXN0DQo+U0FQIGxhbmRzY2FwZXMgb24gYSBnbG9iYWwgc2NhbGUuDQo+V2Ug4oCYZm9s bG93IHRoZSBzdW7igJkgYW5kIGZ1bmN0aW9uIGluIHR3byBodWJzLCBsb2NhdGVkIGluIHRoZSBQ YWxvIEFsdG8NCj5hbmQgQW1zdGVyZGFtIHRvIHByb3ZpZGUgdGhyZWF0IGludGVsbGlnZW5jZSBz ZXJ2aWNlcywgYWdpbGUgc3VwcG9ydA0KPmFuZCBvcGVyYXRlIGxvY2FsIG9mZmljZXMgYW5kIHBh cnRuZXIgbmV0d29yayBzcGFubmluZyAyMCsgY291bnRyaWVzDQo+YXJvdW5kIHRoZSBnbG9iZS4N Cj4NCj4NCj5BZHJlc3MgVVNBOiAyMjggSGFtaWx0b24gQXZlbnVlLCBGbC4gMywgUGFsbyBBbHRv LCBDQS4gOTQzMDENCj5QaG9uZTogNjUwLjc5OC41MjU1DQo+VHdpdHRlcjogQGVycHNjYW4NCj5T Y29vcC1pdDogQnVzaW5lc3MgQXBwbGljYXRpb24gU2VjdXJpdHkNCg==