Welcome!

News Feed Item

Onapsis Research Labs Releases Six New Critical Security Advisories for Companies Using SAP

Latest Threats Target Key Administration Capabilities for SAP HANA and Allow Remote Attackers to Access Restricted Functionality to Gain Access to Any Organization's Secure Information

CAMBRIDGE, MA--(Marketwired - July 30, 2014) - Onapsis, Inc., a leading provider of solutions and research to audit and mitigate advanced threats targeting business-critical applications including Enterprise Resource Planning (ERP), Supply Chain Management (SCM), Finance and Accounting, Human Capital Management and Business Intelligence (BI), has released six new security advisories for SAP users. With more than 250,000 SAP installations in 188 countries, numerous organizations across the world could be impacted by the highlighted vulnerabilities.

The security advisories come from Onapsis Research Labs which continuously investigates, detects and reports exploitable vulnerabilities. The advisories enable vendors to prioritize patches and updates, while Onapsis customer and partner communities benefit from real-time analysis. Onapsis security advisories, together with vendor patches and security notes, are available for download to provide vendors and end-users with the information to mitigate advanced threats.

Onapsis Research Labs experts will be at Black Hat USA 2014 in Las Vegas from August 2-7 (booth #1131) to brief front-line security practitioners on the latest SAP advisories and discuss best practices for mitigating advanced threats. Onapsis customers will gain deep insight into the advisories from the Onapsis Security Research team during the company's exclusive annual customer advisory council on August 4 at the MGM Grand.

"We advise all SAP users to review our advisories and ensure that their systems are protected from the latest threats," said Juan Perez-Etchegoyen, CTO of Onapsis. "Ignored vulnerabilities may compromise SAP systems, but as experts in business critical application security we work to secure and protect systems while continuously monitoring for future vulnerabilities. Our customers receive instant access to fixes and have an advantage over other organizations that fail to protect their 'Crown Jewels'."

The following advisories have been released by experts at Onapsis Research Labs to alert vendors and user communities of the cyber-security risks affecting their business critical systems. Administrators, owners and users can sign up for alerts by clicking here.

  1. Multiple cross-site scripting vulnerabilities in SAP HANA XS Administration Tool
  • Onapsis risk level assessment: Medium (two out of four)
  • Initial Base CVSS v2: 4.3 (AV:N/AC:M/AU:N/C:N/I:P/A:N)
  • Affected components: SAP HANA XS Administration Tool, a web application used to administer and maintain the HANA XS Engine
  • Details: Functions within SAP HANA XS Administration Tool do not sufficiently encode or filter output parameters, resulting in a reflected cross-site scripting vulnerability. A reflected cross-site scripting attack can be used to temporarily deface or modify displayed content for targeted users of the website
  • Solution: SAP has released SAP Note 1993349 to provide patched versions of the affected components
  1. SAP HANA IU5 SDK authentication bypass
  • Onapsis risk level assessment: Medium (two out of four)
  • Initial Base CVSS v2: 5.0 (AV:N/AC:L/AU:N/C:P/I:N/A:N)
  • Affected components: SAP HANA Extended Application Services
  • Details: SAP HANA Extend Application Services (XL) based applications can be set to have 'public' access (i.e. no authentication required). Despite this configuration changing to 'non-public' in the SAP HANA IU5 SDK Application, no authentication is needed to access these applications, which still allow public access
  • Solution: SAP has released SAP Note 1964428 to provide patched versions of the affected components
  1. SAP HANA XS missing encryption in form-based authentication
  • Onapsis risk level assessment: Low (one out of four)
  • Initial Base CVSS v2: 2.9 (AV:A/AC:M/AU:N/C:P/I:N/A:N)
  • Affected components: SAP HANA Extended Application Services. SAP HANA does not enforce any encryption in form-based authentication, enabling anonymous users to get information such as valid credentials from captured network traffic and gain access to the system
  • Details: SAP HANA Extend Application Services (XS) based applications can be set to 'form based authentication' access using SSL. When this configuration is set, the authentication mechanism does not properly enforce the required level of encryption
  • Solution: SAP has released SAP Note 1963932 to provide patched versions of the affected components
  1. HTTP verb tampering issue in SAP_JTECHS
  • Onapsis risk level assessment: Medium (two out of four)
  • Initial Base CVSS v2: 5 (AV:N/AC:L/Au:N/C:N/I:N/A:P)
  • Affected components: SAP Solution Manager 7.1
  • Details: License Measurement Servlet is prone to verb tampering attacks, allowing remote unauthenticated attackers to access restricted functionality. Technical details of this issue are still pending with the purpose of providing time for affected customers to apply the SAP Security Note.
  • Solution: SAP has released SAP Note 1778940 to provide patched versions of the affected components
  1. Hard-coded user name in SAP FI Manager Self-Service
  • Onapsis risk level assessment: Medium (two out of four)
  • Initial Base CVSS v2: 6.0 (AV:N/AC:M/AU:S/C:P/I:P/A:P)
  • Affected components: SAP FI Manager allows management employees to perform their tasks and decision processes using different services and applications from a central location
  • Details: The program contains a hard-coded user name that changes the system's behavior if a user is successfully authenticated. This user may gain access to additional information that should not be displayed
  • Solution: SAP has released SAP Note 1929473 to provide patched versions of the affected components. Download: https://service.sap.com/sap/support/notes/1920323
  1. Missing authorization check in function modules of BW-SYS-DB-DB4
  • Onapsis risk level assessment: Low (one out of four)
  • Initial Base CVSS v2: 3.5 (AV:N/AC:M/AU:S/C:P/I:N/A:N)
  • Affected components: SAP Netweaver Business Warehouse component
  • Details: A remote authenticated attacker could execute the vulnerable RFC functions in function group BW-SYS-DB-DB4. These do not check for authorizations and would allow the attacker to obtain sensitive information regarding the target application server
  • Solution: SAP has released SAP Note 1974016 to provide patched versions of the affected components

    About Onapsis
    Onapsis Inc. is the leading provider of cyber security solutions to audit and protect business-critical applications including Enterprise Resource Planning (ERP), Supply Chain Management (SCM) and Business Intelligence (BI). Onapsis solutions empower information security and audit professionals to understand and efficiently mitigate the cyber security risks affecting their SAP, Oracle and other business-critical applications, preventing espionage, sabotage and financial fraud attacks while streamlining compliance with internal and regulatory requirements.

    As the industry standard, trusted by the leading audit firms and deployed by Global 1000 and military organizations, Onapsis X1 is the most widely-used solution to detect cyber security risks and compliance violations affecting SAP business platforms. Unmatched by generic security monitoring products, Onapsis X1's unique SAP-certified capabilities integrate seamlessly into existing GRC and Risk Management practices, providing unprecedented visibility to protect critical business processes. At the heart of the company, the Onapsis Research Labs consists of the thought-leaders that continue to redefine the ERP security industry.

    For more information please visit www.onapsis.com and follow us on Twitter: @onapsis

More Stories By Marketwired .

Copyright © 2009 Marketwired. All rights reserved. All the news releases provided by Marketwired are copyrighted. Any forms of copying other than an individual user's personal reference without express written permission is prohibited. Further distribution of these materials is strictly forbidden, including but not limited to, posting, emailing, faxing, archiving in a public database, redistributing via a computer network or in a printed form.

Latest Stories
For organizations that have amassed large sums of software complexity, taking a microservices approach is the first step toward DevOps and continuous improvement / development. Integrating system-level analysis with microservices makes it easier to change and add functionality to applications at any time without the increase of risk. Before you start big transformation projects or a cloud migration, make sure these changes won’t take down your entire organization.
"My role is working with customers, helping them go through this digital transformation. I spend a lot of time talking to banks, big industries, manufacturers working through how they are integrating and transforming their IT platforms and moving them forward," explained William Morrish, General Manager Product Sales at Interoute, in this SYS-CON.tv interview at 18th Cloud Expo, held June 7-9, 2016, at the Javits Center in New York City, NY.
With the introduction of IoT and Smart Living in every aspect of our lives, one question has become relevant: What are the security implications? To answer this, first we have to look and explore the security models of the technologies that IoT is founded upon. In his session at @ThingsExpo, Nevi Kaja, a Research Engineer at Ford Motor Company, will discuss some of the security challenges of the IoT infrastructure and relate how these aspects impact Smart Living. The material will be delivered i...
SYS-CON Events announced today that Ocean9will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Ocean9 provides cloud services for Backup, Disaster Recovery (DRaaS) and instant Innovation, and redefines enterprise infrastructure with its cloud native subscription offerings for mission critical SAP workloads.
Your homes and cars can be automated and self-serviced. Why can't your storage? From simply asking questions to analyze and troubleshoot your infrastructure, to provisioning storage with snapshots, recovery and replication, your wildest sci-fi dream has come true. In his session at @DevOpsSummit at 20th Cloud Expo, Dan Florea, Director of Product Management at Tintri, will provide a ChatOps demo where you can talk to your storage and manage it from anywhere, through Slack and similar services ...
Imagine having the ability to leverage all of your current technology and to be able to compose it into one resource pool. Now imagine, as your business grows, not having to deploy a complete new appliance to scale your infrastructure. Also imagine a true multi-cloud capability that allows live migration without any modification between cloud environments regardless of whether that cloud is your private cloud or your public AWS, Azure or Google instance. Now think of a world that is not locked i...
SYS-CON Events announced today that Auditwerx will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Auditwerx specializes in SOC 1, SOC 2, and SOC 3 attestation services throughout the U.S. and Canada. As a division of Carr, Riggs & Ingram (CRI), one of the top 20 largest CPA firms nationally, you can expect the resources, skills, and experience of a much larger firm combined with the accessibility and atten...
In his session at @ThingsExpo, Eric Lachapelle, CEO of the Professional Evaluation and Certification Board (PECB), will provide an overview of various initiatives to certifiy the security of connected devices and future trends in ensuring public trust of IoT. Eric Lachapelle is the Chief Executive Officer of the Professional Evaluation and Certification Board (PECB), an international certification body. His role is to help companies and individuals to achieve professional, accredited and worldw...
MongoDB Atlas leverages VPC peering for AWS, a service that allows multiple VPC networks to interact. This includes VPCs that belong to other AWS account holders. By performing cross account VPC peering, users ensure networks that host and communicate their data are secure. In his session at 20th Cloud Expo, Jay Gordon, a Developer Advocate at MongoDB, will explain how to properly architect your VPC using existing AWS tools and then peer with your MongoDB Atlas cluster. He'll discuss the secur...
SYS-CON Events announced today that Linux Academy, the foremost online Linux and cloud training platform and community, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Linux Academy was founded on the belief that providing high-quality, in-depth training should be available at an affordable price. Industry leaders in quality training, provided services, and student certification passes, its goal is to c...
DevOps is often described as a combination of technology and culture. Without both, DevOps isn't complete. However, applying the culture to outdated technology is a recipe for disaster; as response times grow and connections between teams are delayed by technology, the culture will die. A Nutanix Enterprise Cloud has many benefits that provide the needed base for a true DevOps paradigm. In his Day 3 Keynote at 20th Cloud Expo, Chris Brown, a Solutions Marketing Manager at Nutanix, will explore t...
In his session at Cloud Expo, Alan Winters, an entertainment executive/TV producer turned serial entrepreneur, will present a success story of an entrepreneur who has both suffered through and benefited from offshore development across multiple businesses: The smart choice, or how to select the right offshore development partner Warning signs, or how to minimize chances of making the wrong choice Collaboration, or how to establish the most effective work processes Budget control, or how to m...
Deep learning has been very successful in social sciences and specially areas where there is a lot of data. Trading is another field that can be viewed as social science with a lot of data. With the advent of Deep Learning and Big Data technologies for efficient computation, we are finally able to use the same methods in investment management as we would in face recognition or in making chat-bots. In his session at 20th Cloud Expo, Gaurav Chakravorty, co-founder and Head of Strategy Development ...
SYS-CON Events announced today that SoftLayer, an IBM Company, has been named “Gold Sponsor” of SYS-CON's 18th Cloud Expo, which will take place on June 7-9, 2016, at the Javits Center in New York, New York. SoftLayer, an IBM Company, provides cloud infrastructure as a service from a growing number of data centers and network points of presence around the world. SoftLayer’s customers range from Web startups to global enterprises.
"delaPlex is a software development company. We do team-based outsourcing development," explained Mark Rivers, COO and Co-founder of delaPlex Software, in this SYS-CON.tv interview at 18th Cloud Expo, held June 7-9, 2016, at the Javits Center in New York City, NY.