Advisory
On 12.04.2022 a security relevant correction has been released by SAP SE. The manufacturer resolves an issue within Kernel.
SAP Note 3111311 addresses "[CVE-2022-28772]Denial of service (DOS) in SAP Web Dispatcher and SAP Netweaver (Internet Communication Manager)" to prevent denial of service (dos) with a high risk for exploitation.
A workaround does not exist, according to SAP Security Advisory team. It is advisable to implement the correction as part of maintenance, the team suggests.
Denial of Service (DoS) attacks that take a system offline may lead to significant cost for the company, studies quantify the costs in average between 4 and 5 millions dollars. Business continuity requires SAP systems staying online. The CVSS scores or vulnerability descriptions are not enough to represent how a simple bug can lead to a significant loss for companies.
Risk specification
By overlong input values an attacker may force overwrite of the internal program stack in SAP Web Dispatcher or Internet Communication Manager, which makes these programs unavailable.Solution
The affected code has been updated to properly validate input values
The advisory is valid for
- KERNEL 7.53 33
- KERNEL 7.77 31
- KERNEL 7.81 24
- KERNEL 7.85 22
- KERNEL 7.86 10
- KRNL64UC 7.53 33
- SAP_EXTENDED_APP_SERVICES 1 9
- WEBDISP 7.53 14
- WEBDISP 7.77 13
- WEBDISP 7.81 8
- WEBDISP 7.85 10
- WEBDISP 7.86 3
- XS_ADVANCED_RUNTIME 1.00 10
- 9.8 Multiple vulnerabilities associated with Reprise License Manager 14.2 component used with SAP 3D Visual Enterprise License Manager
- 7.8 [CVE-2023-33990] Denial of service (DOS) vulnerability in SAP SQL Anywhere
- 7.7 [CVE-2023-35871] Memory Corruption vulnerability in SAP Web Dispatcher
- 7.5 [CVE-2023-44487] Denial of service (DOS) in SAP Web Dispatcher, SAP NetWeaver Application server ABAP, and ABAP Platform
- 7.5 Denial of service (DOS) in SAP Commerce
