Schweregrad: : Medium
  Identificador(es) CVE: : CVE-2006-0732
  Data do informe: 15 fevereiro 2011

  Descrição

 Directory traversal vulnerability in SAP Business Connector (BC) 4.6 and 4.7 allows remote attackers to read or delete arbitrary files via the the fullName parameter to (1) sapbc/SAP/chopSAPLog.dsp or (2) invoke/sap.monitor.rfcTrace/deleteSingle.  Details will be updated after the grace period has ended.  NOTE: SAP Business Connector is an OEM version of webMethods Integration Server.  webMethods states that this issue can only occur when the product is installed as root/admin, and if the attacker has access to a general purpose port; however, both are discouraged in the documentation.  In addition, the attacker must already have acquired administrative privileges through other means.

  Exposição das informações

Trend Micro Deep Security shields networks through Deep Packet Inspection (DPI) rules. Trend Micro customers using OfficeScan with Intrusion Defense Firewall (IDF) plugin are also protected from attacks using these vulnerabilities. Please refer to the filter number and filter name when applying appropriate DPI and/or IDF rules.

  Solução

  Trend Micro Deep Security DPI Rule Number: 1002483
  Trend Micro Deep Security DPI Rule Name: 1002483 - SAP Business Connector Remote Arbitrary File Access And Deletion Vulnerability

  Software infectado e versão:

  • SAP Business Connector 4.6
  • SAP Business Connector 4.7