Pierluigi Paganini September 12, 2018

SAP today just released the September 2018 set of Security Notes that address a total of 14 flaws in its products, including a critical flaw in SAP Business Client.

The September 2018 Security Patch Day includes other 13 Security Notes, three were rated High severity, 9 Medium risk, and 1 Low severity. SAP also released 8 Support Package Notes,

The critical vulnerability in SAP Business Client addressed by SAP was rated as Hot News and received a CVSS score of 9.8. The issue affects the browser control Chromium delivered with SAP Business Client. The vulnerability was first addressed by the company on April 2018 Patch Day, but the Security Note was updated with the last security updates.

Other SAP products addressed with the Security Notes are Business One, BEx Web Java Runtime Export Web Service, HANA, WebDynpro, NetWeaver AS Java, Hybris Commerce, Plant Connectivity, Adaptive Server Enterprise, HCM Fiori “People Profile” (GBX01HR), Mobile Platform, Enterprise Financial Services, and Business One Android application.

“SAP has released the monthly critical patch update for September 2018. This patch update closes 22 SAP Security Notes (14 SAP Security Patch Day Notes and 8 Support Package Notes). 3 of all the patches are updates to the previously released Security Notes.” reads a blog post published by security firm ERPScan.

“4 notes are released after the second Tuesday of the previous month and before the second Tuesday of this month.”

Most of the vulnerabilities are Missing Authorization Check, followed by information disclosure, Cross-Site Scripting, and XML External Entity issues.

The most severe flaws in SAP Security Notes are:

• 2670284: SAP Business One and SAP HANA Installer has an Information Disclosure vulnerability (CVSS Base Score: 8.8 CVE-2018-2458).
• 2644279: SAP BEx Web Java Runtime Export Web Service has a Missing XML Validation (XXE) vulnerability (CVSS Base Score: 8.8 CVE-2018-2462).
• 2681207: DOS vulnerability in SAP HANA, Extended Application Services classic model
  Product – SAP HANA; Versions – 1.0, 2.0 (CVE-2018-2465)

The 2681207 was discovered by Martin Doyhenard, a researcher at the Onapsis.

“The attack can be carried out by an attacker by sending a large crafted request to a default API or ODATA services present in a HANA XS system abusing the XML parsing failure of one of the libraries which are used by xsengine to parse XML data strings. The malicious request can be remote and unauthenticated, that is, it does not need to be local or come from an authenticated user and no user credentials are needed.” reads the analysis published by Onapsis.

Pierluigi Paganini

(Security Affairs – Security Notes, SAP)

[adrotate banner=”5″]

[adrotate banner=”13″]