Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
(AV:A/AC:M/AU:S/C:P/I:P/A:PSAP)
Производитель ПО
Наименование ПО
SAP Notes
(1724516-2)
SAP Support Packages
(J2EE_ENGINE_SERVERCORE_710_SP008_000031, J2EE_ENGINE_SERVERCORE_710_SP012_000019, J2EE_ENGINE_SERVERCORE_710_SP013_000010, J2EE_ENGINE_SERVERCORE_710_SP014_000013, J2EE_ENGINE_SERVERCORE_710_SP015_000000, J2EE_ENGINE_SERVERCORE_710_SP016_000000, J2EE_ENGINE_SERVERCORE_710_SP999999_999999, J2EE_ENGINE_SERVERCORE_711_SP007_000019, J2EE_ENGINE_SERVERCORE_711_SP008_000014, J2EE_ENGINE_SERVERCORE_711_SP009_000013, J2EE_ENGINE_SERVERCORE_711_SP010_000000, J2EE_ENGINE_SERVERCORE_711_SP011_000000, J2EE_ENGINE_SERVERCORE_711_SP999999_999999, J2EE_ENGINE_SERVERCORE_720_SP005_000032, J2EE_ENGINE_SERVERCORE_720_SP006_000020, J2EE_ENGINE_SERVERCORE_720_SP007_000016, J2EE_ENGINE_SERVERCORE_720_SP008_000000, J2EE_ENGINE_SERVERCORE_720_SP009_000000, J2EE_ENGINE_SERVERCORE_720_SP999999_999999, J2EE_ENGINE_SERVERCORE_730_SP002_000025, J2EE_ENGINE_SERVERCORE_730_SP003_000026, J2EE_ENGINE_SERVERCORE_730_SP004_000018, J2EE_ENGINE_SERVERCORE_730_SP005_000028, J2EE_ENGINE_SERVERCORE_730_SP007_000011, J2EE_ENGINE_SERVERCORE_730_SP008_000000, J2EE_ENGINE_SERVERCORE_730_SP999999_999999, J2EE_ENGINE_SERVERCORE_731_SP001_000017, J2EE_ENGINE_SERVERCORE_731_SP002_000015, J2EE_ENGINE_SERVERCORE_731_SP003_000009, J2EE_ENGINE_SERVERCORE_731_SP004_000001, J2EE_ENGINE_SERVERCORE_731_SP005_000000, J2EE_ENGINE_SERVERCORE_731_SP999999_999999, JAVA_SP_MANAGER_700_SP024_000002, JAVA_SP_MANAGER_700_SP025_000001, JAVA_SP_MANAGER_700_SP026_000001, JAVA_SP_MANAGER_700_SP027_000000, JAVA_SP_MANAGER_700_SP028_000000, JAVA_SP_MANAGER_700_SP999999_999999, JAVA_SP_MANAGER_701_SP009_000003, JAVA_SP_MANAGER_701_SP010_000002, JAVA_SP_MANAGER_701_SP011_000001, JAVA_SP_MANAGER_701_SP012_000000, JAVA_SP_MANAGER_701_SP013_000000, JAVA_SP_MANAGER_701_SP999999_999999, JAVA_SP_MANAGER_702_SP007_000003, JAVA_SP_MANAGER_702_SP008_000003, JAVA_SP_MANAGER_702_SP009_000004, JAVA_SP_MANAGER_702_SP010_000003, JAVA_SP_MANAGER_702_SP011_000002, JAVA_SP_MANAGER_702_SP012_000000, JAVA_SP_MANAGER_702_SP013_000000, JAVA_SP_MANAGER_702_SP999999_999999, JDI_640_SP028_000002, JDI_640_SP029_000001, JDI_640_SP030_000000, JDI_640_SP031_000000, JDI_640_SP999999_999999, NW_CE_DEVELOPER_STUDIO_710_SP008_000005, NW_CE_DEVELOPER_STUDIO_710_SP012_000004, NW_CE_DEVELOPER_STUDIO_710_SP013_000003, NW_CE_DEVELOPER_STUDIO_710_SP014_000003, NW_CE_DEVELOPER_STUDIO_710_SP015_000000, NW_CE_DEVELOPER_STUDIO_710_SP016_000000, NW_CE_DEVELOPER_STUDIO_710_SP999999_999999, NW_CE_DEVELOPER_STUDIO_711_SP007_000008, NW_CE_DEVELOPER_STUDIO_711_SP008_000008, NW_CE_DEVELOPER_STUDIO_711_SP009_000005, NW_CE_DEVELOPER_STUDIO_711_SP010_000000, NW_CE_DEVELOPER_STUDIO_711_SP011_000000, NW_CE_DEVELOPER_STUDIO_711_SP999999_999999, NW_CE_DEVELOPER_STUDIO_720_SP005_000013, NW_CE_DEVELOPER_STUDIO_720_SP006_000008, NW_CE_DEVELOPER_STUDIO_720_SP007_000006, NW_CE_DEVELOPER_STUDIO_720_SP008_000000, NW_CE_DEVELOPER_STUDIO_720_SP009_000000, NW_CE_DEVELOPER_STUDIO_720_SP999999_999999, NW_DEVELOPER_STUDIO_700_SP024_000002, NW_DEVELOPER_STUDIO_700_SP025_000002, NW_DEVELOPER_STUDIO_700_SP026_000002, NW_DEVELOPER_STUDIO_700_SP027_000000, NW_DEVELOPER_STUDIO_700_SP999999_999999, NW_DEVELOPER_STUDIO_701_SP009_000002, NW_DEVELOPER_STUDIO_701_SP010_000002, NW_DEVELOPER_STUDIO_701_SP011_000002, NW_DEVELOPER_STUDIO_701_SP012_000000, NW_DEVELOPER_STUDIO_701_SP999999_999999, NW_DEVELOPER_STUDIO_702_SP007_000002, NW_DEVELOPER_STUDIO_702_SP008_000002, NW_DEVELOPER_STUDIO_702_SP009_000002, NW_DEVELOPER_STUDIO_702_SP010_000002, NW_DEVELOPER_STUDIO_702_SP011_000002, NW_DEVELOPER_STUDIO_702_SP012_000000, NW_DEVELOPER_STUDIO_702_SP999999_999999, NWDS_UPDATE_SITE_CE_710_SP008_000005, NWDS_UPDATE_SITE_CE_710_SP012_000004, NWDS_UPDATE_SITE_CE_710_SP013_000003, NWDS_UPDATE_SITE_CE_710_SP014_000003, NWDS_UPDATE_SITE_CE_710_SP999999_999999, NWDS_UPDATE_SITE_CE_711_SP007_000008, NWDS_UPDATE_SITE_CE_711_SP008_000008, NWDS_UPDATE_SITE_CE_711_SP009_000005, NWDS_UPDATE_SITE_CE_711_SP010_000000, NWDS_UPDATE_SITE_CE_711_SP999999_999999, NWDS_UPDATE_SITE_CONTENT_730_SP002_000008, NWDS_UPDATE_SITE_CONTENT_730_SP003_000005, NWDS_UPDATE_SITE_CONTENT_730_SP004_000006, NWDS_UPDATE_SITE_CONTENT_730_SP005_000005, NWDS_UPDATE_SITE_CONTENT_730_SP007_000003, NWDS_UPDATE_SITE_CONTENT_730_SP008_000000, NWDS_UPDATE_SITE_CONTENT_730_SP999999_999999, NWDS_UPDATE_SITE_CONTENT_731_SP001_000004, NWDS_UPDATE_SITE_CONTENT_731_SP002_000007, NWDS_UPDATE_SITE_CONTENT_731_SP003_000003, NWDS_UPDATE_SITE_CONTENT_731_SP004_000001, NWDS_UPDATE_SITE_CONTENT_731_SP005_000000, NWDS_UPDATE_SITE_CONTENT_731_SP999999_999999, NWDS_UPDATE_SITE_TOOLS_710_SP008_000005, NWDS_UPDATE_SITE_TOOLS_710_SP012_000004, NWDS_UPDATE_SITE_TOOLS_710_SP013_000003, NWDS_UPDATE_SITE_TOOLS_710_SP014_000003, NWDS_UPDATE_SITE_TOOLS_710_SP999999_999999, NWDS_UPDATE_SITE_TOOLS_711_SP007_000008, NWDS_UPDATE_SITE_TOOLS_711_SP008_000008, NWDS_UPDATE_SITE_TOOLS_711_SP009_000005, NWDS_UPDATE_SITE_TOOLS_711_SP010_000000, NWDS_UPDATE_SITE_TOOLS_711_SP999999_999999, SAP_J2EE_ENGINE_640_SP028_000014, SAP_J2EE_ENGINE_640_SP029_000007, SAP_J2EE_ENGINE_640_SP030_000000, SAP_J2EE_ENGINE_640_SP999999_999999, SAP_JAVA_TECH_SERVICES_700_SP024_000022, SAP_JAVA_TECH_SERVICES_700_SP025_000019, SAP_JAVA_TECH_SERVICES_700_SP026_000012, SAP_JAVA_TECH_SERVICES_700_SP027_000000, SAP_JAVA_TECH_SERVICES_700_SP028_000000, SAP_JAVA_TECH_SERVICES_700_SP999999_999999, SAP_JAVA_TECH_SERVICES_701_SP009_000024, SAP_JAVA_TECH_SERVICES_701_SP010_000023, SAP_JAVA_TECH_SERVICES_701_SP011_000013, SAP_JAVA_TECH_SERVICES_701_SP012_000000, SAP_JAVA_TECH_SERVICES_701_SP013_000000, SAP_JAVA_TECH_SERVICES_701_SP999999_999999, SAP_JAVA_TECH_SERVICES_702_SP007_000025, SAP_JAVA_TECH_SERVICES_702_SP008_000018, SAP_JAVA_TECH_SERVICES_702_SP009_000020, SAP_JAVA_TECH_SERVICES_702_SP010_000017, SAP_JAVA_TECH_SERVICES_702_SP011_000008, SAP_JAVA_TECH_SERVICES_702_SP012_000000, SAP_JAVA_TECH_SERVICES_702_SP013_000000, SAP_JAVA_TECH_SERVICES_702_SP999999_999999, SAP_NW_DEVELOPER_STUDIO_20_SP028_000002, SAP_NW_DEVELOPER_STUDIO_20_SP029_000002, SAP_NW_DEVELOPER_STUDIO_20_SP030_000000, SAP_NW_DEVELOPER_STUDIO_20_SP999999_999999, SAP_SOFTW_DELIV_MANAGER_700_SP024_000004, SAP_SOFTW_DELIV_MANAGER_700_SP025_000004, SAP_SOFTW_DELIV_MANAGER_700_SP026_000003, SAP_SOFTW_DELIV_MANAGER_700_SP027_000000, SAP_SOFTW_DELIV_MANAGER_700_SP028_000000, SAP_SOFTW_DELIV_MANAGER_700_SP999999_999999, SAP_SOFTW_DELIV_MANAGER_701_SP009_000004, SAP_SOFTW_DELIV_MANAGER_701_SP010_000005, SAP_SOFTW_DELIV_MANAGER_701_SP011_000002, SAP_SOFTW_DELIV_MANAGER_701_SP012_000000, SAP_SOFTW_DELIV_MANAGER_701_SP013_000000, SAP_SOFTW_DELIV_MANAGER_701_SP999999_999999, SAP_SOFTW_DELIV_MANAGER_702_SP007_000003, SAP_SOFTW_DELIV_MANAGER_702_SP008_000005, SAP_SOFTW_DELIV_MANAGER_702_SP009_000004, SAP_SOFTW_DELIV_MANAGER_702_SP010_000003, SAP_SOFTW_DELIV_MANAGER_702_SP011_000002, SAP_SOFTW_DELIV_MANAGER_702_SP012_000000, SAP_SOFTW_DELIV_MANAGER_702_SP013_000000, SAP_SOFTW_DELIV_MANAGER_702_SP999999_999999)
Описание
Information about installed products, the versions of those products, data and user passwords can be disclosed by using SDM. This information might be used by an attacker to further target AS Java.An attacker can launch a specifically created request that can cause the SDM server to shut down. As a result, the SDM server cannot be used. This condition can be intentionally provoked by an attacker to cause a denial of service on AS Java.
Как исправить
1. Update the SDM server and the SDM client API to an SP or release where the issue is fixed. See the SP Patch Level section of this SAP note for details and available patches.
2. Enable the security features of SDM by following the instructions in the PDF file attached to this SAP Note.
2. Enable the security features of SDM by following the instructions in the PDF file attached to this SAP Note.
Ссылки
