October Summary – Twenty-one new and updated SAP security patches released, including three HotNews Notes and four High Priority Notes
S/4HANA in focus – Critical Code Injection vulnerability can result in full system compromise
Onapsis Research Labs Contribution – Our team supported SAP in patching ten vulnerabilities covered by eight SAP Security Notes, including two tagged as HotNews and one tagged as High Priority
SAP has published twenty-one new and updated SAP Security Notes in its October Patch Day, including three HotNews Notes and four High Priority Notes. Eight of the seventeen new Security Notes were published in contribution with the Onapsis Research Labs.
The HotNews Notes in Detail
The Onapsis Research Labs (ORL) supported SAP in patching two of the three new HotNews Notes.
SAP Security Note #3797111 ,
SAP Security Note #3805589 ,
SAP Security Note #3798788 ,
The High Priority Notes in Detail
SAP Security Note #3800517 ,
The Onapsis Research Labs(ORL) detected a Memory Corruption vulnerability in SAP NetWeaver ICM and SAP Web Dispatcher that can be exploited to severely negatively affect the availability of the affected application. Due to improper validation of certain fields, an unauthenticated attacker could send malicious requests that trigger a memory-handling error, causing the affected process to crash. SAP Security Note #3765424 ,
SAP Security Note #3485073 ,
SAP Security Note #3626303 ,
The Onapsis Research Labs (ORL) contributed significantly to SAP’s October Patch Day. In addition to two HotNews Notes and one High Priority Note, the ORL supported SAP in patching another seven vulnerabilities covered by five Medium Priority Notes.
The ORL detected two vulnerabilities in SAP Manufacturing Integration and Intelligence (SAP MII) that allow an attacker to store malicious content that is later rendered by the application. If an authenticated victim accesses a page that displays this stored content, the injected input is processed during web page generation, resulting in the execution of malicious content in the victim’s browser context. Successful exploitation could allow the attacker to access session information, modify rendered page content and disrupt the victim’s use of the application. SAP Security Note #3798823 ,
Several vulnerabilities in SAP NetWeaver Enterprise Portal were patched by SAP in collaboration with the ORL team:
SAP Security Note #3790401 ,
SAP Security Note #3779985 ,
SAP Security Note #3789825 ,
SAP Security Note #3794572 ,
Summary & Conclusions
With twenty-one SAP Security Notes, including three HotNews and four High Priority Notes, SAP’s October Patch Day is an average one. With ten vulnerabilities, covered by eight SAP Security Notes, the Onapsis Research Labs could once more significantly contribute to SAP’s Patch Day.
As always, the Onapsis Research Labs is already updating The Onapsis Platform to incorporate the newly published vulnerabilities into the product so that our customers can protect their businesses.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
