SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   Application (Generic)  >   SAP GUI Vendors:   SAP
SAP GUI Heap Overflow in 'sizerone.ocx' Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1021529
SecurityTracker URL:  http://securitytracker.com/id/1021529
CVE Reference:   CVE-2008-4827   (Links to External Site)
Date:  Jan 7 2009
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 6.40 Patch 29, 7.10; possibly other versions
Description:   A vulnerability was reported in SAP GUI. A remote user can cause arbitrary code to be executed on the target user's system.

A remote user can create specially crafted HTML that, when loaded by the target user, will trigger a heap overflow in the TabOne ActiveX control (sizerone.ocx) and execute arbitrary code on the target system. The code will run with the privileges of the target user.

The vendor was notified on November 13, 2008.

Carsten Eiram of Secunia Research reported this vulnerability.

Impact:   A remote user can create HTML that, when loaded by the target user, will execute arbitrary code on the target user's system.
Solution:   The vendor has issued a fix (7.10 PL).

The vendor's advisory is available in SAP note 1092631.

Vendor URL:  www.sap.com/ (Links to External Site)
Cause:   Boundary error
Underlying OS:   Windows (Any)

Message History:   None.


 Source Message Contents

Date:  Wed, 7 Jan 2009 13:52:56 +0100
Subject:  [Full-disclosure] Secunia Research: SAP GUI TabOne ActiveX Control

====================================================================== 

                     Secunia Research XX/XX/200X

   - SAP GUI TabOne ActiveX Control Caption List Buffer Overflow -

====================================================================== 
Table of Contents

Affected Software....................................................1
Severity.............................................................2
Vendor's Description of Software.....................................3
Description of Vulnerability.........................................4
Solution.............................................................5
Time Table...........................................................6
Credits..............................................................7
References...........................................................8
About Secunia........................................................9
Verification........................................................10

====================================================================== 
1) Affected Software 

* SAP GUI 6.40 Patch 29
* SAP GUI 7.10

NOTE: Other versions may also be affected.

====================================================================== 
2) Severity 

Rating: Highly critical
Impact: System compromise
Where:  Remote

====================================================================== 
3) Vendor's Description of Software 

"SAP GUI is SAP's universal client for accessing SAP functionality in
SAP applications such as - SAP ERP, SAP Business Suite (SAP CRM, SAP
SCM and SAP PLM), SAP Business Intelligence and so on. SAP GUI
functions like a browser. It gets information from the SAP server like
what, where, when and how, to display contents in its window.".

Product Link:
https://www.sdn.sap.com/irj/sdn/sap-gui

====================================================================== 
4) Description of Vulnerability

Secunia Research has discovered a vulnerability in SAP GUI, which 
can be exploited by malicious people to potentially compromise a 
user's system.

The vulnerability is caused due to a boundary error in the included
TabOne ActiveX control (sizerone.ocx) when copying tab captions. This
can be exploited to cause a heap-based buffer overflow by e.g. adding
multiple tabs via the "AddTab()" method.

Successful exploitation may allow execution of arbitrary code.

====================================================================== 
5) Solution 

Update to the latest 7.10 PL, which sets the kill-bit for the ActiveX
control.

Users can also set the kill-bit manually by following the procedure 
explained in SAP note 1092631.

====================================================================== 
6) Time Table 

13/11/2008 - Vendor notified.
13/11/2008 - Vendor response.
05/11/2008 - Vendor provides status update and informs that a patch has 
             been released for 7.10, which sets the kill-bit.
07/01/2009 - Public disclosure.

====================================================================== 
7) Credits 

Discovered by Carsten Eiram, Secunia Research.

====================================================================== 
8) References

The Common Vulnerabilities and Exposures (CVE) project has assigned 
CVE-2008-4827 for the vulnerability.

====================================================================== 
9) About Secunia

Secunia offers vulnerability management solutions to corporate
customers with verified and reliable vulnerability intelligence
relevant to their specific system configuration:

http://secunia.com/advisories/business_solutions/

Secunia also provides a publicly accessible and comprehensive advisory
database as a service to the security community and private 
individuals, who are interested in or concerned about IT-security.

http://secunia.com/advisories/

Secunia believes that it is important to support the community and to
do active vulnerability research in order to aid improving the 
security and reliability of software in general:

http://secunia.com/secunia_research/

Secunia regularly hires new skilled team members. Check the URL below
to see currently vacant positions:

http://secunia.com/corporate/jobs/

Secunia offers a FREE mailing list called Secunia Security Advisories:

http://secunia.com/advisories/mailing_lists/

====================================================================== 
10) Verification 

Please verify this advisory by visiting the Secunia website:
http://secunia.com/secunia_research/2008-53/

Complete list of vulnerability reports published by Secunia Research:
http://secunia.com/secunia_research/

======================================================================

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC