Actu
Vigil@nce: SAP NetWeaver, denial of service via XRFC
November 2010 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/
SYNTHESIS OF THE VULNERABILITY
An authenticated attacker can send a malicious XML RFC query, in
order to create a denial of service in SAP NetWeaver.
– Severity: 2/4
– Creation date: 18/11/2010
DESCRIPTION OF THE VULNERABILITY
The SAP XRFC (XML Remote Function Call) service manages SOAP
queries in XML format.
When the SOAP query contains several elements, the function
calling stack gets filled, so the work.exe process stops.
An authenticated attacker (or users EARLYWATCH, SAPCPIC, TMSADM)
can therefore send a malicious RFC SOAP query, in order to create
a denial of service in SAP NetWeaver.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/SAP-NetWeaver-denial-of-service-via-XRFC-10134
