Advisory Details

March 16th, 2010

SAP MaxDB Malformed Handshake Request Remote Code Execution Vulnerability

ZDI-10-032
ZDI-CAN-610

CVE ID CVE-2010-1185
CVSS SCORE 10.0, (AV:N/AC:L/Au:N/C:C/I:C/A:C)
AFFECTED VENDORS SAP
AFFECTED PRODUCTS MaxDB
TIPPINGPOINT™ IPS CUSTOMER PROTECTION TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 9403. For further product information on the TippingPoint IPS: http://www.tippingpoint.com
VULNERABILITY DETAILS

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SAP MaxDB. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the serv.exe process which listens by default on TCP port 7210. The process trusts a value from a handshake packet and uses it as a length when copying data to the stack. If provided a malicious value and packet data, this can be leveraged to execute arbitrary code under the context of the SYSTEM user.

VENDOR RESPONSE SAP states:

A solution was provided via SAP note 1409425 (https://service.sap.com/sap/support/notes/1409425)


DISCLOSURE TIMELINE
  • 2009-11-09 - Vulnerability reported to vendor
  • 2010-03-16 - Coordinated public release of advisory
CREDIT AbdulAziz Hariri of Insight Technologies
BACK TO ADVISORIES