Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
(AV:N/AC:L/AU:N/C:N/I:N/A:PSAP)
Производитель ПО
Наименование ПО
SAP Notes
(1725390-3)
SAP Support Packages
(J2EE_ENGINE_LM_CORE_711_SP011_000000, J2EE_ENGINE_LM_CORE_711_SP999999_999999, J2EE_ENGINE_LM_CORE_720_SP009_000000, J2EE_ENGINE_LM_CORE_720_SP999999_999999, J2EE_ENGINE_LM_CORE_730_SP009_000000, J2EE_ENGINE_LM_CORE_730_SP999999_999999, J2EE_ENGINE_LM_CORE_731_SP006_000000, J2EE_ENGINE_LM_CORE_731_SP999999_999999, SAP_J2EE_ENGINE_640_SP026_000032, SAP_J2EE_ENGINE_640_SP027_000028, SAP_J2EE_ENGINE_640_SP028_000017, SAP_J2EE_ENGINE_640_SP029_000011, SAP_J2EE_ENGINE_640_SP030_000003, SAP_J2EE_ENGINE_640_SP031_000000, SAP_J2EE_ENGINE_640_SP999999_999999, SAP_JAVA_TECH_SERVICES_640_SP031_000000, SAP_JAVA_TECH_SERVICES_640_SP999999_999999, SAP_JAVA_TECH_SERVICES_700_SP024_000024, SAP_JAVA_TECH_SERVICES_700_SP025_000021, SAP_JAVA_TECH_SERVICES_700_SP026_000015, SAP_JAVA_TECH_SERVICES_700_SP027_000003, SAP_JAVA_TECH_SERVICES_700_SP028_000000, SAP_JAVA_TECH_SERVICES_700_SP029_000000, SAP_JAVA_TECH_SERVICES_700_SP999999_999999, SAP_JAVA_TECH_SERVICES_701_SP009_000026, SAP_JAVA_TECH_SERVICES_701_SP010_000026, SAP_JAVA_TECH_SERVICES_701_SP011_000016, SAP_JAVA_TECH_SERVICES_701_SP012_000004, SAP_JAVA_TECH_SERVICES_701_SP013_000000, SAP_JAVA_TECH_SERVICES_701_SP999999_999999, SAP_JAVA_TECH_SERVICES_702_SP006_000023, SAP_JAVA_TECH_SERVICES_702_SP007_000027, SAP_JAVA_TECH_SERVICES_702_SP008_000020, SAP_JAVA_TECH_SERVICES_702_SP009_000023, SAP_JAVA_TECH_SERVICES_702_SP010_000020, SAP_JAVA_TECH_SERVICES_702_SP011_000011, SAP_JAVA_TECH_SERVICES_702_SP012_000001, SAP_JAVA_TECH_SERVICES_702_SP013_000000, SAP_JAVA_TECH_SERVICES_702_SP999999_999999)
Описание
The problem is caused by a program error in Generic Request and Message Generator (GRMG) due to the incorrect use of an XML parser.By default, the parser opens external entities referenced within an XML input, which can then lead to malicious content being parsed. This malicious content can reference internal resources, such as files. These internal resources can be disclosed in the response to the request, or can be used to perform a denial of service attack on the parsing system, rending application content temporarily unavailable.
Как исправить
Please use the recent version of the support package:---------------------------------------------------------------| Release | Supp. package | Patched component |---------------------------------------------------------------| 6.40 | SAPJEE.SAR | grmg.SDA |---------------------------------------------------------------| 7.00 - 7.02 | SAPJTECHS.SCA | grmg.SDA |---------------------------------------------------------------| 7.11 - 7.31 | LMCORE.SCA | com.sap.util.monitor.grmg.SDA |---------------------------------------------------------------You will find the corresponding patch number of the package in the SP Patch level section of this noteThe fix is in the included patched component. You can use SDM to deploy only the component grmg.SDA.The instance restart will be necessory to restore the GRMG monitoring.Caution: If you decide to import the entire support package SAPJTECHS.SCA, you have to import the last avilable SAPJTECHF.SCA (SAP JAVA TECHNOLOGY S OFFLINE) to avoid issues in WebDynproRuntime. Please check SAP note 1395627 for details.
Ссылки
