SAP NetWeaver up to 7.0 EHP2 disp+work.exe DiagTraceR3Info access control
CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
6.6 | $0-$5k | 0.00 |
A vulnerability, which was classified as critical, has been found in SAP NetWeaver up to 7.0 EHP2 (Solution Stack Software). This issue affects the function DiagTraceR3Info
of the component disp+work.exe. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-264. Impacted is confidentiality, integrity, and availability. The summary by CVE is:
The kSBXProfileNoNetwork and kSBXProfileNoInternet sandbox profiles in Apple Mac OS X 10.5.x through 10.7.x do not propagate restrictions to all created processes, which allows remote attackers to access network resources via a crafted application, as demonstrated by use of osascript to send Apple events to the launchd daemon, a related issue to CVE-2008-7303.
The weakness was presented 05/08/2012 by Martin Gallo (aceh) with Core Security Technologies as CORE-2012-0123 as confirmed knowledge base article (Website). The advisory is shared at coresecurity.com. The public release was coordinated in cooperation with SAP. The identification of this vulnerability is CVE-2011-1516 since 03/23/2011. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details as well as a public exploit are known. MITRE ATT&CK project uses the attack technique T1068 for this issue.
A public exploit has been developed by Core Security in Python and been published 1 days after the advisory. The exploit is available at exploit-db.com. It is declared as proof-of-concept. We expect the 0-day to have been worth approximately $25k-$100k.
Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.
The vulnerability is also documented in the databases at X-Force (71284) and Exploit-DB (18853). See 5392, 60742, 60741 and 60740 for similar entries.
Product
Type
Vendor
Name
Version
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 7.3VulDB Meta Temp Score: 6.6
VulDB Base Score: 7.3
VulDB Temp Score: 6.6
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Access controlCWE: CWE-264
ATT&CK: T1068
Local: No
Remote: Yes
Availability: 🔍
Access: Public
Status: Proof-of-Concept
Author: Core Security
Programming Language: 🔍
Download: 🔍
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
OpenVAS ID: 803223
OpenVAS Name: Apple Mac OS X Predefined Sandbox Profiles Security Bypass Vulnerability
OpenVAS File: 🔍
OpenVAS Family: 🔍
Exploit-DB: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: PatchStatus: 🔍
Reaction Time: 🔍
Exposure Time: 🔍
Exploit Delay Time: 🔍
Timeline
03/23/2011 🔍11/10/2011 🔍
11/15/2011 🔍
11/15/2011 🔍
01/24/2012 🔍
01/24/2012 🔍
02/02/2012 🔍
05/08/2012 🔍
05/08/2012 🔍
05/09/2012 🔍
05/09/2012 🔍
05/09/2012 🔍
05/09/2012 🔍
05/10/2012 🔍
05/15/2012 🔍
04/09/2017 🔍
Sources
Vendor: sap.comAdvisory: CORE-2012-0123
Researcher: Martin Gallo (aceh)
Organization: Core Security Technologies
Status: Confirmed
Coordinated: 🔍
CVE: CVE-2011-1516 (🔍)
X-Force: 71284
SecurityTracker: 1027052 - SAP NetWeaver Dispatcher Bugs Let Remote Users Execute Arbitrary Code and Deny Service
Vulnerability Center: 34380 - Apple MacOS X Sandbox Profiles Bypass Restrictions to Network Resources via a Crafted Application, High
SecurityFocus: 50644 - Apple Mac OS X Predefined Sandbox Profiles Remote Security Bypass Weakness
Secunia: 48980 - SAP NetWeaver Denial of Service and Code Execution Vulnerabilities, Moderately Critical
OSVDB: 81759
scip Labs: https://www.scip.ch/en/?labs.20150716
See also: 🔍
Entry
Created: 05/15/2012 11:52Updated: 04/09/2017 14:25
Changes: 05/15/2012 11:52 (82), 04/09/2017 14:25 (13)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.