Advisory
SAP takes the security of its vast product portfolio very seriously and thus releases security fixes for
vulnerabilities reported by external researchers and their customers every second Tuesday of the month.
SAP Note 3340735
was released on
11.07.2023 and deals with
"[CVE-2023-35871] Memory Corruption vulnerability in SAP Web Dispatcher" within Kernel.
We advice you to follow the instructions, to resolve
denial of service (dos)
with a
high potential for exploitation
in component BC-CST-WDP.
According to SAP Security Advisory team a workaround exists. It is advisable to implement the correction as part of maintenance.
Denial of Service (DoS) attacks that take a system offline may lead to significant cost for the company, studies quantify the costs in average between 4 and 5 millions dollars. Business continuity requires SAP systems staying online. The CVSS scores or vulnerability descriptions are not enough to represent how a simple bug can lead to a significant loss for companies.
Risk specification
The SAP Web Dispatcher allows an unauthenticated attacker to cause memory corruption through logical errors in memory management, resulting in a denial of service vulnerability.Solution
The correction removes the error in the memory management and prevents memory corruption. Alternativly, the consulting team has proposed the following: "To apply workaround for your specific refer to the instructions in the note.Please assess the workaround applicability for your SAP landscape prior to implementation.Note that this workaround is a temporary fix and is not a permanent solution. SAP strongly recommends you apply the corrections outlined in the security note, which can be done in lieu of the workaround or after the workaround is implemented.". The suggestion may be considered, as a workaround or compensating mitigation. We recommend installing/applying the correction wherever possible and as soon as possible. Base your decision on whether or not to apply the patch on your companies and systems risk perspective and consider the provided CVSS 7.7 score.
The advisory is valid for
- HDB 2.00 12
- KERNEL 7.53 33
- KERNEL 7.54 12
- KERNEL 7.77 31
- KERNEL 7.85 22
- KERNEL 7.89 13
- KERNEL 7.91 5
- KERNEL 7.92 4
- KERNEL 7.93 7
- KRNL64UC 7.53 33
- SAP_EXTENDED_APP_SERVICES 1 9
- WEBDISP 7.53 14
- WEBDISP 7.54 6
- WEBDISP 7.77 13
- WEBDISP 7.85 10
- WEBDISP 7.89 6
- WEBDISP 7.91
- WEBDISP 7.92
- WEBDISP 7.93 2
- XS_ADVANCED_RUNTIME 1.00 10
- 9.8 Multiple vulnerabilities associated with Reprise License Manager 14.2 component used with SAP 3D Visual Enterprise License Manager
- 7.8 [CVE-2023-33990] Denial of service (DOS) vulnerability in SAP SQL Anywhere
- 7.5 [CVE-2023-32111] Memory Corruption vulnerability in SAP PowerDesigner (Proxy)
- 7.5 [CVE-2020-6186] Denial of Service (DOS) Vulnerability in SAP Host Agent
- 7.5 [CVE-2022-28772]Denial of service (DOS) in SAP Web Dispatcher and SAP Netweaver (Internet Communication Manager)
