Story image

Security experts find critical vulnerabilities in SAP’s mail systems

27 Mar 2017

Serious vulnerabilities were exposed in SAP systems worldwide, leaving them open to business data theft, business process disruption, fraud and many other forms of attacks.

ERP Security (ERP-SEC) discovered the vulnerabilities and says they related directly to SAP’s inbound email processing functionality.

Joris van de Vis, ERP-SEC researcher, demonstrated the vulnerabilities at the annual ‘Troopers Security Conference’, which has a special track dedicated to SAP security.

The team worked closely with SAP Product Security Response team to resolve and patch the vulnerabilities. As a result, SAP released Security Note 2308217 to mitigate them.

“SAP collaborates frequently with research companies such as ERP-SEC to ensure a responsible disclosure of vulnerabilities. The vulnerabilities in question have been fixed by SAP and the patches have been made available for download since June 2016. Our recommendation to all our customers is to implement SAP secure patches as soon as they are available - typically on the second Tuesday of every month. Timely security patching of SAP systems is the best policy to protect SAP infrastructure from attacks," a statement from SAP says.

According to SAP’s website, the Security Note 2308217, released in June 2016, is specifically for:

“SAP Web-Survey has an XML external entity vulnerability (CVSS Base Score: 7.5 ). An attacker can use an XML external entity vulnerability to send specially crafted unauthorized XML requests which will be processed by XML parser. An attacker can use an XML external entity vulnerability to get unauthorised access to OS filesystem. Install this SAP Security Note to prevent risks.”

Van de Vis says the percentage of affected customers is unclear, but around 50% use inbound mail capabilities in their SAP systems.

“The impact of these vulnerabilities can be severe for SAP customers that use the inbound mail processing functionality as it can be exploited over the internet and without authentication. In some cases we even managed to completely take over SAP systems by sending just one email to them with a specially crafted attachment,” comments van de Vis.

Aerohive launches guide to cloud-managed network access control
NAC for Dummies teaches the key aspects of network access control within enterprise IT networks and how you can secure all devices on the network.
Sungard AS named DRaaS leader by Forrester
It was noted for its disaster-recovery-as-a-service solution’s ability to “serve client needs at all stages of their need for business continuity.”
Gartner: The five priorities of privacy executives
The priorities highlight the need for strategic approaches to engage with shifting regulatory, technology, customer and third-party risk trends.
emt Distribution adds risk intelligence vendor
Flashpoint has signed emt Distribution to provide channel partners in Oceania and South East Asia a solution for illicit threat actor communities.
CrowdStrike: Improving network security with cloud computing solutions
Australian spending on public cloud services is expected to reach $6.5 billion this year according to Gartner
Thycotic debunks top Privileged Access Management myths
Privileged Access encompasses access to computers, networks and network devices, software applications, digital documents and other digital assets.
Veeam reports double-digit Q1 growth
We are now focussed on an aggressive strategy to help businesses transition to cloud with Backup and Cloud Data Management solutions.
Paving the road to self-sovereign identity using blockchain
Internet users are often required to input personal information and highly-valuable data from contact numbers to email addresses to make use of the various platforms and services available online.