SAP NetWeaver msg_server.exe buffer overflow

VulDB: SAP NetWeaver msg_server.exe buffer overflow

General

SAP

scipID: 5630
Affected: SAP NetWeaver
Published: 06/28/2012 (e6af8de8b1d4b2b6d5ba2610cbf9cd38)
Risk: critical
Entry: 87% complete
Created: 07/04/2012

Summary

A vulnerability, which was classified as critical, has been found in SAP NetWeaver. Affected by this issue is an unknown function of the component msg_server.exe. The manipulation with an unknown input leads to a buffer overflow vulnerability. Impacted is confidentiality, integrity, and availability.

The weakness was published 06/28/2012 by e6af8de8b1d4b2b6d5ba2610cbf9cd38 with Zero Day Initiative as ZDI-12-104 as advisory (ZDI). The advisory is shared for download at zerodayinitiative.com. The public release has been coordinated with the vendor. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details are unknown but a private exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 244 days.

The best possible mitigation is suggested to be patching the affected component. The vulnerability is also documented in the databases at OSVDB (83494) and Secunia (SA49744).