Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
(AV:N/AC:M/AU:N/C:P/I:N/A:NSAP)
Производитель ПО
Наименование ПО
SAP Notes
(1823687-3)
SAP Support Packages
(SAP_KERNEL_721_32_BIT_SP115_000115, SAP_KERNEL_721_32_BIT_SP999999_999999, SAP_KERNEL_721_32_BIT_UNICODE_SP115_000115, SAP_KERNEL_721_32_BIT_UNICODE_SP999999_999999, SAP_KERNEL_721_64_BIT_SP115_000115, SAP_KERNEL_721_64_BIT_SP999999_999999, SAP_KERNEL_721_64_BIT_UNICODE_SP115_000115, SAP_KERNEL_721_64_BIT_UNICODE_SP999999_999999, SAP_KERNEL_721_EXT_32_BIT_SP115_000115, SAP_KERNEL_721_EXT_32_BIT_SP999999_999999, SAP_KERNEL_721_EXT_32_BIT_UC_SP115_000115, SAP_KERNEL_721_EXT_32_BIT_UC_SP999999_999999, SAP_KERNEL_721_EXT_64_BIT_SP115_000115, SAP_KERNEL_721_EXT_64_BIT_SP999999_999999, SAP_KERNEL_721_EXT_64_BIT_UC_SP115_000115, SAP_KERNEL_721_EXT_64_BIT_UC_SP999999_999999, SAP_KERNEL_740_64_BIT_SP013_000013, SAP_KERNEL_740_64_BIT_SP014_000014, SAP_KERNEL_740_64_BIT_SP999999_999999, SAP_KERNEL_740_64_BIT_UNICODE_SP013_000013, SAP_KERNEL_740_64_BIT_UNICODE_SP014_000014, SAP_KERNEL_740_64_BIT_UNICODE_SP999999_999999, SAPKB73108, SAPKB74003)
Описание
Information such as the existence of users can be discovered using a failed logon attempt.This information may be used by an attacker to further target system access by password logon.
Как исправить
Configure the ABAP server to reply all logon attempts which fail due to invalid or not validated credentials with an error message not disclosing any details regarding the failure reason.This requires a new kernel as well as an ABAP correction (Support Package or manual correction). After applying both corrections (ABAP and Kernel) you can set the new profile parameter login/show_detailed_errors to value 0.------------------------------------------------------------------------|Manual Activity |------------------------------------------------------------------------|VALID FOR ||Software Component SAP_BASIS SAP Basis compo...|| Release 700 All Support Package Levels || Release 710 All Support Package Levels || Release 711 All Support Package Levels || Release 701 All Support Package Levels || Release 702 All Support Package Levels || Release 730 All Support Package Levels || Release 720 All Support Package Levels || Release 731 Until SAPKB73107 || Release 740 Until SAPKB74002 |------------------------------------------------------------------------Use transaction RZ11 and switch to maintenance mode (via the menu item "Goto"->"Maintenance Mode"). Then press "Create" to add a new profile parameter (after applying the kernel patch) named "login/show_detailed_errors" (caution: case-sensitive).
Ссылки
