Researcher finds flaw in SAP's MaxDB

Summary:A security researcher has found a remote command execution exploit in SAP's MaxDB database on the Windows, Linux and Solaris platforms.Researcher Luigi Auriemma published the flaw in MaxDB versions 7.

A security researcher has found a remote command execution exploit in SAP's MaxDB database on the Windows, Linux and Solaris platforms.

Researcher Luigi Auriemma published the flaw in MaxDB versions 7.6.03 build 007 and below. MaxDB (all ZDNet resources and SAP wiki) is an SAP-certified open source database. MaxDB powers SAP's Business ByDesign. In October, MySQL and SAP announced that support for MaxDB will be handled by SAP.

Auriemma describes the following:

The MaxDB server executes "cons.exe DATABASE COMMAND" through system() when some special commands are called by the user. Some of these special commands are "show" and "exec_sdbinfo" and this last one is just one of the small amount of commands which can be executed by the unauthenticated users before logging in.

The usage of system() for executing the cons program allows an external unauthenticated attacker to execute any command he wants on the target SAP MaxDB server simply passing the "&&" or other patterns for the execution of multiple commands in the shell.

So it's just enough to use the following SAP command to see the content of C: on Windows (the bug is naturally exploitable on any other platform supported by the server):

exec_sdbinfo && echo dir c:\ | cmd.exe

Then the rest and all the other possibilities of exploiting this vulnerability are in the fantasy of the attacker...

There's no fix for this flaw.

Topics: Data Management, Data Centers, Enterprise Software, Hardware, Open Source, Operating Systems, SAP, Security, Servers, Software, Storage, Windows

About

Larry Dignan is Editor in Chief of ZDNet and SmartPlanet as well as Editorial Director of ZDNet's sister site TechRepublic. He was most recently Executive Editor of News and Blogs at ZDNet. Prior to that he was executive news editor at eWeek and news editor at Baseline. He also served as the East Coast news editor and finance editor at CN... Full Bio

zdnet_core.socialButton.googleLabel Contact Disclosure

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Related Stories

The best of ZDNet, delivered

You have been successfully signed up. To sign up for more newsletters or to manage your account, visit the Newsletter Subscription Center.
Subscription failed.