[ERPSCAN-11-017] SAP GUI — Buffer overflow

DSECRG Advisories

Application: SAP GUI
Versions Affected: 7.1, 7.2
Vendor URL: http://www.sap.com
Bugs: Buffer Overflow
Reported: 20.08.2010
Vendor response: 23.08.2010
Date of Public Advisory: 12.04.2011
Author: Dmitry Chastuhin

Attacker can construct saplogon.ini file which contains vulnerable tag which is vulnerable to buffer overflow attack. For example attacker can overwrite this file on fileserver from which users install their SAPGUI updates. It also can be exploited on terminal server for taking control on other users data.

Business Risk
An attacker can send a malicious link to an unaware user using e-mail, messaging or social networks. He also can insert this link into corporate portal. When clicking this link the end user browser will call vulnerable ActiveX component and overflow a stack buffer resulting in arbitrary code execution under the context of the user running the browser. It can be used by attacker to gain full control on victim’s workstation.