Exploit-DB #32919
Description: SAP Router - Timing Attack Password Disclosure
Type: remote
Platform: hardware
Date: 2014-04-17
Author: Core Security

Exploit:
Core Security - Corelabs Advisory
http://corelabs.coresecurity.com/

SAP Router Password Timing Attack


1. *Advisory Information*

Title: SAP Router Password Timing Attack
Advisory ID: CORE-2014-0003
Advisory URL:
http://www.coresecurity.com/advisories/sap-router-password-timing-attack
Date published: 2014-04-15
Date of last update: 2014-03-06
Vendors contacted: SAP
Release mode: Coordinated release


2. *Vulnerability Information*

Class: Information Exposure Through Timing Discrepancy [CWE-208]
Impact: Security bypass
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2014-0984


3. *Vulnerability Description*


      SAP Router [1]  is an application-level gateway used to
      connect systems in a SAP infrastructure. A vulnerability
      have been found in SAP Router that could allow an unauthenticated
      remote attacker to obtain passwords used to protect route entries
by a
      timing side-channel attack.
    


4. *Vulnerable Packages*

   . SAP Router release 721 patch level 117.
   . SAP Router release 720 patch level 411.
   . SAP Router release 710 patch level 029.
   . Other versions are probably affected too, but they were not checked.

5. *Vendor Information, Solutions and Workarounds*


      SAP released the security note
https://service.sap.com/sap/support/notes/1986895
      regarding these issues. Contact SAP for further information.
    


      Martin Gallo proposed the following actions to mitigate the
      impact of the vulnerabilities:
      

   1. Disable the use of passwords on the Route Permission Table [2].
      
   2. Enforce the use of SNC (Secure Network Communications) as an
      authentication mechanism for securing routes.
        

6. *Credits*


      This vulnerability was discovered and researched by Martin Gallo
from Core
      Security Consulting Services. The publication of this advisory was
      coordinated by Fernando Miranda from Core Advisories Team.
    


7. *Technical Description / Proof of Concept Code*


      SAP Router permits and/or forbids networks connections based on a
      Route Permission Table [2]. Entries in the
      Route Permission Table can have a password. If a password is
specified
      for a given entry in the Route Permission Table, SAP Router checks
whether
      the user-supplied password matches with the one in the Route
Permission
      Table entry before permitting a connection.
    


      The vulnerable function 'passwordCheck'
      performs a non-constant time string comparison for checking the
      user-supplied password against the on in the Route Permission Table.
      On the first non-matched character, the string comparison function
      immediately interrupts the evaluation cycle, which may let an
attacker perform timing attacks.
      The following snippet shows an excerpt of the vulnerable code
within the
      'passwordCheck' function:
    


/-----
.text:[PII_REDACTED]005BE0 loc_140005BE0:                          ; CODE
XREF: passwordCheck+191j
.text:[PII_REDACTED]005BE0                 movzx   ecx, byte ptr [rdi] ; rdi
points to the routtab password
.text:[PII_REDACTED]005BE3                 movzx   eax, byte ptr [rdi+rsi] ;
rdi+rsi points to the user-supplied password
.text:[PII_REDACTED]005BE7                 sub     ecx, eax
.text:[PII_REDACTED]005BE9                 jnz     short loc_140005BF3 ;
password check failed
.text:[PII_REDACTED]005BEB                 add     rdi, 1
.text:[PII_REDACTED]005BEF                 test    eax, eax
.text:[PII_REDACTED]005BF1                 jnz     short loc_140005BE0
.text:[PII_REDACTED]005BF3
.text:[PII_REDACTED]005BF3 loc_140005BF3:                          ; CODE
XREF: passwordCheck+189j
.text:[PII_REDACTED]005BF3                 test    ecx, ecx
.text:[PII_REDACTED]005BF5                 jz      short loc_140005C3F
.text:[PII_REDACTED]005BF7                 cmp     cs:trace_level, 1
.text:[PII_REDACTED]005BFE                 jl      short loc_140005C38
.text:[PII_REDACTED]005C00                 call    DpLock
.text:[PII_REDACTED]005C05                 mov     rcx, cs:qword_140273BC0
.text:[PII_REDACTED]005C0C                 lea     r8, aPasswordcheck ;
"passwordCheck"
.text:[PII_REDACTED]005C13                 lea     rdx, aSPasswordCheck ;
"%s: password check failed\n"
.text:[PII_REDACTED]005C1A                 mov     cs:dword_1401ADAA4, 1
.text:[PII_REDACTED]005C24                 call    DpTrace
.text:[PII_REDACTED]005C29
.text:[PII_REDACTED]005C29 loc_140005C29:                          ; CODE
XREF: passwordCheck+16Fj
.text:[PII_REDACTED]005C29                 mov     cs:dword_1401ADAA4, 2
.text:[PII_REDACTED]005C33                 call    DpUnlock
.text:[PII_REDACTED]005C38
.text:[PII_REDACTED]005C38 loc_140005C38:                          ; CODE
XREF: passwordCheck+135j
.text:[PII_REDACTED]005C38                                         ;
passwordCheck+19Ej
.text:[PII_REDACTED]005C38                 mov     eax, 0FFFFFFA2h
.text:[PII_REDACTED]005C3D                 jmp     short loc_140005C41
.text:[PII_REDACTED]005C3F ;
---------------------------------------------------------------------------
.text:[PII_REDACTED]005C3F
.text:[PII_REDACTED]005C3F loc_140005C3F:                          ; CODE
XREF: passwordCheck+12Cj
.text:[PII_REDACTED]005C3F                                         ;
passwordCheck+174j ...
.text:[PII_REDACTED]005C3F                 xor     eax, eax        ;
password check succeeded

-----/


7.1. *Proof of Concept*


/-----
#!/usr/bin/python
## ===========
## pysap - Python library for crafting SAP's network protocols packets
##
## Copyright (C) 2014 Core Security Technologies
##
## The library was designed and developed by Martin Gallo from the Security
## Consulting Services team of Core Security Technologies.
##
## This program is free software; you can redistribute it and/or
## modify it under the terms of the GNU General Public License
## as published by the Free