Flaw found in thousands of SAP servers

By

Vulnerabilities to be demonstrated at Black Hat

Thousands of SAP servers on the internet could be affected by vulnerabilities that bypass authentication checks, a researcher will demonstrate at Black Hat 2011.

Flaw found in thousands of SAP servers

Alexander Polyako, chief technology officer at ERPScan, found flaws in the J2EE engine of SAP NetWeaver software that could allow an attacker to assign themselves administrative privileges.

"For example, it is possible to create a user and assign to the administrators group using two unauthorised requests to the system," Polyako said.

"It is also dangerous because that attack is possible on systems protected by two-factor authentication."

The company demonstrated the vulnerabilities with a tool that searches for SAP servers with undisclosed keywords. It found that "more than half of [detected] servers could be hacked" using the vulnerability.

The vulnerabilities could affect many more SAP servers built with custom configuration, according to Polyako.

Got a news tip for our journalists? Share it with us anonymously here.

Copyright © SC Magazine, Australia

Tags:

Most Read Articles

Ex-student charged over Western Sydney University cyberattacks

Ex-student charged over Western Sydney University cyberattacks

Home Affairs officer accessed data on "friends and associates"

Home Affairs officer accessed data on "friends and associates"

SA Water plans 'once-in-a-generation' core technology uplift

SA Water plans 'once-in-a-generation' core technology uplift

Sportsbet recruits 'security champions' in shift-left strategy

Sportsbet recruits 'security champions' in shift-left strategy

Log In

  |  Forgot your password?