Click here to close now.

SYS-CON MEDIA Authors: Carmen Gonzalez, Kevin Jackson, Peter Silva, Greg Wind, Glenn Rossman

News Feed Item

Onapsis Research Labs Releases Six New Critical Security Advisories for Companies Using SAP

Latest Threats Target Key Administration Capabilities for SAP HANA and Allow Remote Attackers to Access Restricted Functionality to Gain Access to Any Organization's Secure Information

CAMBRIDGE, MA--(Marketwired - July 30, 2014) - Onapsis, Inc., a leading provider of solutions and research to audit and mitigate advanced threats targeting business-critical applications including Enterprise Resource Planning (ERP), Supply Chain Management (SCM), Finance and Accounting, Human Capital Management and Business Intelligence (BI), has released six new security advisories for SAP users. With more than 250,000 SAP installations in 188 countries, numerous organizations across the world could be impacted by the highlighted vulnerabilities.

The security advisories come from Onapsis Research Labs which continuously investigates, detects and reports exploitable vulnerabilities. The advisories enable vendors to prioritize patches and updates, while Onapsis customer and partner communities benefit from real-time analysis. Onapsis security advisories, together with vendor patches and security notes, are available for download to provide vendors and end-users with the information to mitigate advanced threats.

Onapsis Research Labs experts will be at Black Hat USA 2014 in Las Vegas from August 2-7 (booth #1131) to brief front-line security practitioners on the latest SAP advisories and discuss best practices for mitigating advanced threats. Onapsis customers will gain deep insight into the advisories from the Onapsis Security Research team during the company's exclusive annual customer advisory council on August 4 at the MGM Grand.

"We advise all SAP users to review our advisories and ensure that their systems are protected from the latest threats," said Juan Perez-Etchegoyen, CTO of Onapsis. "Ignored vulnerabilities may compromise SAP systems, but as experts in business critical application security we work to secure and protect systems while continuously monitoring for future vulnerabilities. Our customers receive instant access to fixes and have an advantage over other organizations that fail to protect their 'Crown Jewels'."

The following advisories have been released by experts at Onapsis Research Labs to alert vendors and user communities of the cyber-security risks affecting their business critical systems. Administrators, owners and users can sign up for alerts by clicking here.

  1. Multiple cross-site scripting vulnerabilities in SAP HANA XS Administration Tool
  • Onapsis risk level assessment: Medium (two out of four)
  • Initial Base CVSS v2: 4.3 (AV:N/AC:M/AU:N/C:N/I:P/A:N)
  • Affected components: SAP HANA XS Administration Tool, a web application used to administer and maintain the HANA XS Engine
  • Details: Functions within SAP HANA XS Administration Tool do not sufficiently encode or filter output parameters, resulting in a reflected cross-site scripting vulnerability. A reflected cross-site scripting attack can be used to temporarily deface or modify displayed content for targeted users of the website
  • Solution: SAP has released SAP Note 1993349 to provide patched versions of the affected components
  1. SAP HANA IU5 SDK authentication bypass
  • Onapsis risk level assessment: Medium (two out of four)
  • Initial Base CVSS v2: 5.0 (AV:N/AC:L/AU:N/C:P/I:N/A:N)
  • Affected components: SAP HANA Extended Application Services
  • Details: SAP HANA Extend Application Services (XL) based applications can be set to have 'public' access (i.e. no authentication required). Despite this configuration changing to 'non-public' in the SAP HANA IU5 SDK Application, no authentication is needed to access these applications, which still allow public access
  • Solution: SAP has released SAP Note 1964428 to provide patched versions of the affected components
  1. SAP HANA XS missing encryption in form-based authentication
  • Onapsis risk level assessment: Low (one out of four)
  • Initial Base CVSS v2: 2.9 (AV:A/AC:M/AU:N/C:P/I:N/A:N)
  • Affected components: SAP HANA Extended Application Services. SAP HANA does not enforce any encryption in form-based authentication, enabling anonymous users to get information such as valid credentials from captured network traffic and gain access to the system
  • Details: SAP HANA Extend Application Services (XS) based applications can be set to 'form based authentication' access using SSL. When this configuration is set, the authentication mechanism does not properly enforce the required level of encryption
  • Solution: SAP has released SAP Note 1963932 to provide patched versions of the affected components
  1. HTTP verb tampering issue in SAP_JTECHS
  • Onapsis risk level assessment: Medium (two out of four)
  • Initial Base CVSS v2: 5 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
  • Affected components: SAP Solution Manager 7.1
  • Details: License Measurement Servlet is prone to verb tampering attacks, allowing remote unauthenticated attackers to access restricted functionality. Technical details of this issue are still pending with the purpose of providing time for affected customers to apply the SAP Security Note.
  • Solution: SAP has released SAP Note 1778940 to provide patched versions of the affected components
  1. Hard-coded user name in SAP FI Manager Self-Service
  • Onapsis risk level assessment: Medium (two out of four)
  • Initial Base CVSS v2: 6.0 (AV:N/AC:M/AU:S/C:P/I:P/A:P)
  • Affected components: SAP FI Manager allows management employees to perform their tasks and decision processes using different services and applications from a central location
  • Details: The program contains a hard-coded user name that changes the system's behavior if a user is successfully authenticated. This user may gain access to additional information that should not be displayed
  • Solution: SAP has released SAP Note 1929473 to provide patched versions of the affected components. Download: https://service.sap.com/sap/support/notes/1920323
  1. Missing authorization check in function modules of BW-SYS-DB-DB4
  • Onapsis risk level assessment: Low (one out of four)
  • Initial Base CVSS v2: 3.5 (AV:N/AC:M/AU:S/C:P/I:N/A:N)
  • Affected components: SAP Netweaver Business Warehouse component
  • Details: A remote authenticated attacker could execute the vulnerable RFC functions in function group BW-SYS-DB-DB4. These do not check for authorizations and would allow the attacker to obtain sensitive information regarding the target application server
  • Solution: SAP has released SAP Note 1974016 to provide patched versions of the affected components

    About Onapsis
    Onapsis Inc. is the leading provider of cyber security solutions to audit and protect business-critical applications including Enterprise Resource Planning (ERP), Supply Chain Management (SCM) and Business Intelligence (BI). Onapsis solutions empower information security and audit professionals to understand and efficiently mitigate the cyber security risks affecting their SAP, Oracle and other business-critical applications, preventing espionage, sabotage and financial fraud attacks while streamlining compliance with internal and regulatory requirements.

    As the industry standard, trusted by the leading audit firms and deployed by Global 1000 and military organizations, Onapsis X1 is the most widely-used solution to detect cyber security risks and compliance violations affecting SAP business platforms. Unmatched by generic security monitoring products, Onapsis X1's unique SAP-certified capabilities integrate seamlessly into existing GRC and Risk Management practices, providing unprecedented visibility to protect critical business processes. At the heart of the company, the Onapsis Research Labs consists of the thought-leaders that continue to redefine the ERP security industry.

    For more information please visit www.onapsis.com and follow us on Twitter: @onapsis

More Stories By Marketwired .

Copyright © 2009 Marketwired. All rights reserved. All the news releases provided by Marketwired are copyrighted. Any forms of copying other than an individual user's personal reference without express written permission is prohibited. Further distribution of these materials is strictly forbidden, including but not limited to, posting, emailing, faxing, archiving in a public database, redistributing via a computer network or in a printed form.

Latest Stories
WSM International is launching a DevOps services division that offers assessment, consulting and implementation to large enterprises and organizations with complex infrastructures. This is the first independent services company to create a dedicated practice to help organizations looking to transition to the DevOps model. The concept of DevOps is to blend information technology (IT) software development with operations to optimize the computing infrastructure according to the specific needs of ...
SYS-CON Events announced today that Cisco, the worldwide leader in IT that transforms how people connect, communicate and collaborate, has been named “Gold Sponsor” of SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Cisco makes amazing things happen by connecting the unconnected. Cisco has shaped the future of the Internet by becoming the worldwide leader in transforming how people connect, communicate and collaborat...
The WebRTC Summit 2014 New York, to be held June 9-11, 2015, at the Javits Center in New York, NY, announces that its Call for Papers is open. Topics include all aspects of improving IT delivery by eliminating waste through automated business models leveraging cloud technologies. WebRTC Summit is co-located with 16th International Cloud Expo, @ThingsExpo, Big Data Expo, and DevOps Summit.
Temasys has announced senior management additions to its team. Joining are David Holloway as Vice President of Commercial and Nadine Yap as Vice President of Product. Over the past 12 months Temasys has doubled in size as it adds new customers and expands the development of its Skylink platform. Skylink leads the charge to move WebRTC, traditionally seen as a desktop, browser based technology, to become a ubiquitous web communications technology on web and mobile, as well as Internet of Things...
SYS-CON Events announced today that robomq.io will exhibit at SYS-CON's @ThingsExpo, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. robomq.io is an interoperable and composable platform that connects any device to any application. It helps systems integrators and the solution providers build new and innovative products and service for industries requiring monitoring or intelligence from devices and sensors.
Hosted PaaS providers have given independent developers and startups huge advantages in efficiency and reduced time-to-market over their more process-bound counterparts in enterprises. Software frameworks are now available that allow enterprise IT departments to provide these same advantages for developers in their own organization. In his workshop session at DevOps Summit, Troy Topnik, ActiveState’s Technical Product Manager, will show how on-prem or cloud-hosted Private PaaS can enable organ...
DevOps tasked with driving success in the cloud need a solution to efficiently leverage multiple clouds while avoiding cloud lock-in. Flexiant today announces the commercial availability of Flexiant Concerto. With Flexiant Concerto, DevOps have cloud freedom to automate the build, deployment and operations of applications consistently across multiple clouds. Concerto is available through four disruptive pricing models aimed to deliver multi-cloud at a price point everyone can afford.
Today, IT is not just a cost center. IT is an enabler and driver of business. With the emergence of the hybrid cloud paradigm, IT now has increasingly more capabilities to create new strategic opportunities for a business. Hybrid cloud allows an organization to utilize multi-tenant public clouds, dedicated private clouds, bare metal hosting, and the associated support and services for the right use cases through an on-demand, XaaS model. This model of IT creates tremendous opportunities for busi...
Docker is an excellent platform for organizations interested in running microservices. It offers portability and consistency between development and production environments, quick provisioning times, and a simple way to isolate services. In his session at DevOps Summit at 16th Cloud Expo, Shannon Williams, co-founder of Rancher Labs, will walk through these and other benefits of using Docker to run microservices, and provide an overview of RancherOS, a minimalist distribution of Linux designed...
Business as usual for IT is evolving into a “Make or Buy” decision on a service-by-service conversation with input from the LOBs. How does your organization move forward with cloud? In his general session at 16th Cloud Expo, Paul Maravei, Regional Sales Manager, Hybrid Cloud and Managed Services at Cisco, discusses how Cisco and its partners offer a market-leading portfolio and ecosystem of cloud infrastructure and application services that allow you to uniquely and securely combine cloud busi...
Businesses are looking to empower employees and departments to do more, go faster, and streamline their processes. For all workers – but mobile workers especially – utilizing the cloud to reconnect documents and improve processes without destructing existing workflows can have a dramatic impact on productivity. In his session at 16th Cloud Expo, Mark Grilli, vice president of Acrobat Solutions marketing at Adobe Systems Incorporated, will outline new ways that the cloud is changing the way peo...
Wearable technology was dominant at this year’s International Consumer Electronics Show (CES) , and MWC was no exception to this trend. New versions of favorites, such as the Samsung Gear (three new products were released: the Gear 2, the Gear 2 Neo and the Gear Fit), shared the limelight with new wearables like Pebble Time Steel (the new premium version of the company’s previously released smartwatch) and the LG Watch Urbane. The most dramatic difference at MWC was an emphasis on presenting we...
SYS-CON Events announced today that Vitria Technology, Inc. will exhibit at SYS-CON’s @ThingsExpo, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Vitria will showcase the company’s new IoT Analytics Platform through live demonstrations at booth #330. Vitria’s IoT Analytics Platform, fully integrated and powered by an operational intelligence engine, enables customers to rapidly build and operationalize advanced analytics to deliver timely business outcomes ...
Are your applications getting in the way of your business strategy? It’s time to rethink your IT approach. In his session at 16th Cloud Expo, Madhukar Kumar, Vice President, Product Management at Liaison Technologies, will discuss a new data-centric approach to IT that allows your data, not applications, to inform business strategy. By moving away from an application-centric IT model where data integration and analysis are subservient to the constraints of applications, your organization will b...
SYS-CON Events announced today that MangoApps will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY., and the 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. MangoApps provides private all-in-one social intranets allowing workers to securely collaborate from anywhere in the world and from any device. Social, mobile, and eas...