[Full-disclosure] Context IS Advisory - SAP Host Control Remote Code Execution

[Context IS - Disclosure <disclosure@xxxxxxxxxxxxxxx>]

===============================ADVISORY===============================
Systems Affected:    SAP AG Netweaver 7.02
Severity:            High
Category:            Remote Code Execution
Author:              Michael Jordon, Context Information Security
Reported to vendor:  16th September 2011
Advisory Issued:     17th August 2012
===============================ADVISORY===============================

Description
-----------
The SAPHostControl Service was found to be vulnerable to remote argument 
injection.  This vulnerability allows for full 
command execution as the SAP administrator through the SOAP management console 
from an unauthenticated perspective. 

Analysis
--------
The issue relates to how the web service passes arguements into the database 
command line as part of the authentication 
process.  By manipulating these arguments a database script can be created and 
run which will execute commands as the SAP 
administrator on the target server. 
For further details on the vulnerability and exploit see:
http://www.contextis.com/research/blog/sap4/
 
Technologies Affected
---------------------
SAP NetWeaver 7.02 (SAPHostControl Service)

Vendor Response
---------------
SAP release a patch for the issue ref: 1341333. 
https://websmp130.sap-ag.de/sap/support/notes/1341333

Disclosure Timeline
-------------------
16th September 2011 – Vendor Disclosure
8th May 2012 - Patch Released
17th August 2012 - Advisory Issued (SAP requested 3 months delay between patch 
release and advisory being issued)

Credits
--------
Michael Jordon of Context Information Security

About Context Information Security
----------------------------------------------
Context Information Security is an independent security consultancy 
specialising in both technical security and information 
assurance services.
The company was founded in 1998. Its client base has grown steadily over the 
years, thanks in large part to personal 
recommendations from existing clients who value us as business partners. We 
believe our success is based on the value our 
clients place on our product-agnostic, holistic approach; the way we work 
closely with them to develop a tailored service; 
and to the independence, integrity and technical skills of our consultants.
Context are ideally placed to work with clients worldwide with offices in the 
UK, Australia and Germany.
The company’s client base now includes some of the most prestigious blue chip 
companies in the world, as well as government 
organisations.
The best security experts need to bring a broad portfolio of skills to the job, 
so Context has always sought to recruit 
staff with extensive business experience as well as technical expertise. Our 
aim is to provide effective and practical 
solutions, advice and support: when we report back to clients we always 
communicate our findings and recommendations in 
plain terms at a business level as well as in the form of an in-depth technical 
report.

Web:  www.contextis.com
Email:   disclosure@xxxxxxxxxxxxx
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/