Sign-up

ID

VAR-200511-0078


CVE

CVE-2005-3634


TITLE

SAP Web Application Server URI Redirecting vulnerability

Trust: 0.6

sources: CNNVD: CNNVD-200511-180

DESCRIPTION

frameset.htm in the BSP runtime in SAP Web Application Server (WAS) 6.10 through 7.00 allows remote attackers to log users out and redirect them to arbitrary web sites via a close command in the sap-sessioncmd parameter and a URL in the sap-exiturl parameter. It is reported that an attacker can exploit this issue by supplying the URI of a malicious site through the 'sap-exiturl' parameter. A successful attack may result in various attacks including theft of cookie-based authentication credentials. An attacker may also be able to exploit this vulnerability to enhance phishing style attacks. This issue only affects the BSP runtime of SAP WAS. 1) Input passed to the "sap-syscmd" parameter in "fameset.htm" and the "BspApplication" field in the "SYSTEM PUBLIC" test application isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. Other versions may also be affected. 2) Input passed to the query string in pages generating error messages isn't properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site. Prior versions may also be affected. 3) The problem is that an absolute URL for an external site can be specified in the "sapexiturl" parameter passed to "fameset.htm". This can be exploited to trick users into visiting a malicious web site by following a specially crafted link with a trusted hostname redirecting to the malicious web site. Other versions may also be affected. 4) Input passed to the "sap-exiturl" parameter isn't properly sanitised before being returned to the user. This can be exploited to inject arbitrary HTTP headers, which will be included in the response sent to the user. Other versions may also be affected. SOLUTION: The vendor has reportedly provided a solution for the vulnerabilities. Customers should contact the SAP's support for further information. PROVIDED AND/OR DISCOVERED BY: Leandro Meiners, Cybsec S.A. ORIGINAL ADVISORY: http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_Multiple_XSS_in_SAP_WAS.pdf http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_Phishing_Vector_in_SAP_WAS.pdf http://www.cybsec.com/vuln/CYBSEC_Security_Advisory_HTTP_Response_Splitting_in_SAP_WAS.pdf ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 1.26

sources: NVD: CVE-2005-3634 // BID: 15362 // PACKETSTORM: 41457

AFFECTED PRODUCTS

vendor:sapmodel:web application serverscope:eqversion:7.0

Trust: 1.9

vendor:sapmodel:web application serverscope:eqversion:6.40

Trust: 1.9

vendor:sapmodel:web application serverscope:eqversion:6.20

Trust: 1.9

vendor:sapmodel:web application serverscope:eqversion:6.10

Trust: 1.9

sources: BID: 15362 // NVD: CVE-2005-3634 // CNNVD: CNNVD-200511-180

CVSS

SEVERITY

CVSSV2

CVSSV3

NVD: CVE-2005-3634
value: MEDIUM

Trust: 1.0

CNNVD: CNNVD-200511-180
value: MEDIUM

Trust: 0.6

NVD:
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: FALSE
obtainAllPrivilege: FALSE
obtainUserPrivilege: FALSE
obtainOtherPrivilege: FALSE
userInteractionRequired: FALSE
version: 2.0

Trust: 1.0

sources: NVD: CVE-2005-3634 // CNNVD: CNNVD-200511-180

PROBLEMTYPE DATA

problemtype:NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2005-3634

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200511-180

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-200511-180

CONFIGURATIONS

sources:
            
            
            NVD: CVE-2005-3634

EXTERNAL IDS
db:BIDid:15362
Trust: 1.9
db:SECUNIAid:17515
Trust: 1.7
db:SREASONid:163
Trust: 1.6
db:VUPENid:ADV-2005-2361
Trust: 1.6
db:SECTRACKid:1015174
Trust: 1.6
db:NVDid:CVE-2005-3634
Trust: 1.6
db:XFid:23031
Trust: 0.6
db:BUGTRAQid:20051109 CYBSEC - SECURITY ADVISORY: PHISHING VECTOR IN SAP WAS
Trust: 0.6
db:CNNVDid:CNNVD-200511-180
Trust: 0.6
db:PACKETSTORMid:41457
Trust: 0.1
sources:
            
            
            BID: 15362 // 
            
            
            
            PACKETSTORM: 41457 // 
            
            
            
            NVD: CVE-2005-3634 // 
            
            
            
            CNNVD: CNNVD-200511-180

REFERENCES
url:http://www.cybsec.com/vuln/cybsec_security_advisory_multiple_xss_in_sap_was.pdf
Trust: 1.7
url:http://secunia.com/advisories/17515/
Trust: 1.7
url:http://securityreason.com/securityalert/163
Trust: 1.6
url:http://www.securityfocus.com/bid/15362
Trust: 1.6
url:http://www.securitytracker.com/alerts/2005/nov/1015174.html
Trust: 1.6
url:http://marc.info/?l=bugtraq&m=113156525006667&w=2
Trust: 1.0
url:http://www.vupen.com/english/advisories/2005/2361
Trust: 1.0
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/23031
Trust: 1.0
url:http://marc.theaimsgroup.com/?l=bugtraq&m=113156525006667&w=2
Trust: 0.6
url:http://xforce.iss.net/xforce/xfdb/23031
Trust: 0.6
url:http://www.frsirt.com/english/advisories/2005/2361
Trust: 0.6
url:http://www.sap.com
Trust: 0.3
url:/archive/1/416150
Trust: 0.3
url:http://secunia.com/product/6087/
Trust: 0.1
url:http://secunia.com/secunia_security_advisories/
Trust: 0.1
url:http://secunia.com/about_secunia_advisories/
Trust: 0.1
url:http://www.cybsec.com/vuln/cybsec_security_advisory_phishing_vector_in_sap_was.pdf
Trust: 0.1
url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Trust: 0.1
url:http://secunia.com/product/3327/
Trust: 0.1
url:http://www.cybsec.com/vuln/cybsec_security_advisory_http_response_splitting_in_sap_was.pdf
Trust: 0.1
sources:
            
            
            BID: 15362 // 
            
            
            
            PACKETSTORM: 41457 // 
            
            
            
            NVD: CVE-2005-3634 // 
            
            
            
            CNNVD: CNNVD-200511-180

CREDITS
Leandro Meiners
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-200511-180

SOURCES
db:BIDid:15362
db:PACKETSTORMid:41457
db:NVDid:CVE-2005-3634
db:CNNVDid:CNNVD-200511-180

LAST UPDATE DATE
2023-12-18T12:53:36.516000+00:00

SOURCES UPDATE DATE
db:BIDid:15362date:2005-11-09T00:00:00
db:NVDid:CVE-2005-3634date:2017-07-11T01:33:15.563
db:CNNVDid:CNNVD-200511-180date:2005-11-23T00:00:00

SOURCES RELEASE DATE
db:BIDid:15362date:2005-11-09T00:00:00
db:PACKETSTORMid:41457date:2005-11-10T23:56:45
db:NVDid:CVE-2005-3634date:2005-11-16T21:22:00
db:CNNVDid:CNNVD-200511-180date:2005-11-16T00:00:00