cfo-as logo
Story image

Security experts find critical vulnerabilities in SAP’s mail systems

27 Mar 2017

Serious vulnerabilities were exposed in SAP systems worldwide, leaving them open to business data theft, business process disruption, fraud and many other forms of attacks.

ERP Security (ERP-SEC) discovered the vulnerabilities and says they related directly to SAP’s inbound email processing functionality.

Joris van de Vis, ERP-SEC researcher, demonstrated the vulnerabilities at the annual ‘Troopers Security Conference’, which has a special track dedicated to SAP security.

The team worked closely with SAP Product Security Response team to resolve and patch the vulnerabilities. As a result, SAP released Security Note 2308217 to mitigate them.

“SAP collaborates frequently with research companies such as ERP-SEC to ensure a responsible disclosure of vulnerabilities. The vulnerabilities in question have been fixed by SAP and the patches have been made available for download since June 2016. Our recommendation to all our customers is to implement SAP secure patches as soon as they are available - typically on the second Tuesday of every month. Timely security patching of SAP systems is the best policy to protect SAP infrastructure from attacks," a statement from SAP says.

According to SAP’s website, the Security Note 2308217, released in June 2016, is specifically for:

“SAP Web-Survey has an XML external entity vulnerability (CVSS Base Score: 7.5 ). An attacker can use an XML external entity vulnerability to send specially crafted unauthorized XML requests which will be processed by XML parser. An attacker can use an XML external entity vulnerability to get unauthorised access to OS filesystem. Install this SAP Security Note to prevent risks.”

Van de Vis says the percentage of affected customers is unclear, but around 50% use inbound mail capabilities in their SAP systems.

“The impact of these vulnerabilities can be severe for SAP customers that use the inbound mail processing functionality as it can be exploited over the internet and without authentication. In some cases we even managed to completely take over SAP systems by sending just one email to them with a specially crafted attachment,” comments van de Vis.

Story image
Innovation Summit East Asia 2020: The significance of sustainability and resilience to business success
Schneider Electric's Innovation Summit East Asia 2020 on 4 November will leverage the experience of experts to deliver informative sessions on how to stay agile by utilising resilient and sustainable strategies.More
Story image
IDC: Digital infrastructure will be the catalyst for success post-pandemic
If organisations properly apply the key digital infrastructure tenets - technology adoption and IT governance - then revenue growth and business expansion will soon follow, according to the research.More
Story image
Teradata releases Vantage solution on Google Cloud for A/NZ customers
"Teradata is committed to providing the best enterprise data analytics in the cloud. For us, this means offering our customers modern data analytics, but also flexibility with deployment options that don’t limit choice or lock them in."More
Story image
BlackLine buys out Rimilia & boosts accounts receivable automation
BlackLine’s acquisition enables the company to improve end-to-end automation of the cash lifecycle and improve data integrity.More
Story image
Cloud use widespread but lacks depth, Contino report reveals
While just 1% of enterprises have no cloud use at all, just 13% have fully-realised, business-wide cloud adoption programmes.More
Story image
Q&A: SnapLogic CTO makes the case for investment in machine learning
SnapLogic field chief technology officer Brad Drysdale discusses the roadblocks to a successful machine learning implementation and the ways they can overcome them.More