## https://sploitus.com/exploit?id=1337DAY-ID-26750
Application: SAP ASE
Versions Affected: SAP ASE ODATA Server v16
Vendor URL: http://SAP.com
Bugs: Denial of Service
Sent: 01.02.2016
Reported: 02.02.2016
Vendor response: 02.02.2016
Date of Public Advisory: 12.10.2016
Reference: SAP Security Note 2330422
Author: Vahagn @vah_13 Vardanyan (ERPScan)
Description
1. ADVISORY INFORMATION
Title:[ERPSCAN-16-036] SAP ASE ODATA SERVER a DENIAL OF SERVICE
Advisory ID:[ERPSCAN-16-036]
Risk: high
Advisory URL:
https://erpscan.com/advisories/erpscan-16-036-sap-ase-odata-server-denial-service/
Date published: 11.01.2017
Vendors contacted: SAP
2. VULNERABILITY INFORMATION
Class: Denial of Service
Impact: Resource Exhaustion
Remotely Exploitable: yes
Locally Exploitable: no
CVE: CVE-2017-5371
CVSS Information
CVSS Base Score v3: 7.5 / 10
CVSS Base Vector:
AV : Attack Vector (Related exploit range) Network (N)
AC : Attack Complexity (Required attack complexity) Low (L)
PR : Privileges Required (Level of privileges needed to exploit) None (N)
UI : User Interaction (Required user participation) None (N)
S : Scope (Change in scope due to impact caused to components beyond the
vulnerable component) Unchanged (U)
C : Impact to Confidentiality None (N)
I : Impact to Integrity None (N)
A : Impact to Availability High (H)
3. VULNERABILITY DESCRIPTION
An attacker can trigger a condition in which the process ceases to run.
This condition can be intentionally provoked by an attacker to cause
a denial of service.
4. VULNERABLE PACKAGES
SIQ
16.0
SQL_ANYWHERE_PERSONAL_SERVER
16.0
SYBASE_ASE_SERVER
15.7
SYBASE_ASE_SERVER
16.0
SYBASE_ASE_CE_SERVER
15.7
5. SOLUTIONS AND WORKAROUNDS
To correct this vulnerability, install SAP Security Note 2330422
6. AUTHOR
Vahagn Vardanyan (ERPScan)
7. TECHNICAL DESCRIPTION
By sending the special request to the SAP ASE Odata Server
(C:\SAP\ODATA-16_0\bin64), you can crash it.
8. REPORT TIMELINE
Reported: 02.02.2016
Vendor response: 02.02.2016
Date of Public Advisory: 12.10.2016
9. REFERENCES
https://erpscan.com/advisories/erpscan-16-036-sap-ase-odata-server-denial-service/
# 0day.today [2018-02-17] #