SAProuter password Timed Attack Vulnerability

SAProuter password Timed Attack Vulnerability

Release date:
Updated on:

Affected Systems:
SAP SAProuter 721 patch level 117
SAP SAProuter 720 patch level 411
SAP SAProuter 710 patch level 029
Description:
--------------------------------------------------------------------------------
Bugtraq id: 66938
CVE (CAN) ID: CVE-2014-0984
 
SAProuter is an application-level gateway used to connect systems in the SAP architecture.
 
SAProuter allows or disables network connections through the "routing permission table". The table contains a password. In patch level 721 patch level 117,720 patch level 411,710 patch level 029, the evaluation cycle is immediately interrupted when the passwordCheck function verifies unmatched passwords, through timed bypass attacks, attackers can restore the plain text "routing permission table" password.
 
<* Source: Martin Gallo

Link: http://secunia.com/advisories/57993/
*>

Suggestion:
--------------------------------------------------------------------------------
Temporary solution:
 
* Disable the password on the "route permission table.
* Use "secure network communication" SNC as the authentication mechanism for secure routing.
 
Vendor patch:
 
SAP
---
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:
 
Https://service.sap.com/sap/support/notes/
Http://www.coresecurity.com/advisories/sap-router-password-timing-attack

Refer:
[1] http://help.sap.com/saphelp_nw74/helpdata/en/48/7612ed5ca5055ee10000000a42189b/content.htm? Frameset =/en/ea/214d2aafaa43feaee78375cb16552f/frameset.htm.
[2] http://help.sap.com/saphelp_nw74/helpdata/en/48/6c7a3fc1504e6ce10000000a421937/content.htm? Frameset =/en/ea/214d2aafaa43feaee78375cb16552f/frameset.htm
[3] http://citeseerx.ist.psu.edu/viewdoc/summary? Doi = 10.1.1.65.9811
[4] http://www.youtube.com/watch? V = idjDiBtu93Y & feature = related
[5] http://events.ccc.de/congress/2011/Fahrplan/attachments/2021_Slides
[6] SAP security note 1986895
Https://service.sap.com/sap/support/notes/1986895.
 
Http://www.coresecurity.com/advisories/sap-router-password-timing-attack#sthash.ENWowiji.dpuf