Vulnerabilities > CVE-2008-0621 - Improper Restriction of Operations Within the Bounds of A Memory Buffer vulnerability in SAP Sapgui, Saplpd and Sapsprint

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
PARTIAL
network
low complexity
sap
CWE-119
nessus
exploit available
metasploit

Summary

Buffer overflow in SAPLPD 6.28 and earlier included in SAP GUI 7.10 and SAPSprint before 1018 allows remote attackers to execute arbitrary code via long arguments to the (1) 0x01, (2) 0x02, (3) 0x03, (4) 0x04, and (5) 0x05 LPD commands.

Vulnerable Configurations

Part Description Count
Application
Sap
3

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.

Exploit-Db

  • descriptionSAP SAPLPD 6.28 Buffer Overflow. CVE-2008-0621. Remote exploit for windows platform
    idEDB-ID:16338
    last seen2016-02-01
    modified2010-05-09
    published2010-05-09
    reportermetasploit
    sourcehttps://www.exploit-db.com/download/16338/
    titleSAP SAPLPD 6.28 - Buffer Overflow
  • idEDB-ID:5079

Metasploit

descriptionThis module exploits a stack buffer overflow in SAPlpd 6.28 (SAP Release 6.40) . By sending an overly long argument, an attacker may be able to execute arbitrary code.
idMSF:EXPLOIT/WINDOWS/LPD/SAPLPD
last seen2020-05-26
modified2017-07-24
published2008-02-10
referenceshttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0621
reporterRapid7
sourcehttps://github.com/rapid7/metasploit-framework/blob/master//modules/exploits/windows/lpd/saplpd.rb
titleSAP SAPLPD 6.28 Buffer Overflow

Nessus

  • NASL familyMisc.
    NASL idSAPLPD_6_29.NASL
    descriptionSAPlpd, a component of SAP GUI, is running on the remote host. According to its version number, the installation of SAPlpd running on the remote host is affected by several denial of service and buffer overflow vulnerabilities. An unauthenticated, remote attacker can leverage these issues to crash the affected service or to execute arbitrary code on the affected host subject to the privileges under which it operates.
    last seen2020-06-01
    modified2020-06-02
    plugin id31121
    published2008-02-20
    reporterThis script is Copyright (C) 2008-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/31121
    titleSAPlpd < 6.29 Multiple Vulnerabilities
    code
    #
    #  (C) Tenable Network Security, Inc.
    #
    
    
    
    include("compat.inc");
    
    if (description)
    {
      script_id(31121);
      script_version("1.12");
    
      script_cve_id("CVE-2008-0620", "CVE-2008-0621");
      script_bugtraq_id(27613);
      script_xref(name:"Secunia", value:"28786");
    
      script_name(english:"SAPlpd < 6.29 Multiple Vulnerabilities");
      script_summary(english:"Queries SAPlpd for its version"); 
     
     script_set_attribute(attribute:"synopsis", value:
    "The remote print service is affected by multiple vulnerabilities." );
     script_set_attribute(attribute:"description", value:
    "SAPlpd, a component of SAP GUI, is running on the remote host. 
    
    According to its version number, the installation of SAPlpd running on
    the remote host is affected by several denial of service and buffer
    overflow vulnerabilities.  An unauthenticated, remote attacker can
    leverage these issues to crash the affected service or to execute
    arbitrary code on the affected host subject to the privileges under
    which it operates." );
     script_set_attribute(attribute:"see_also", value:"http://aluigi.altervista.org/adv/saplpdz-adv.txt" );
     script_set_attribute(attribute:"see_also", value:"https://seclists.org/bugtraq/2008/Feb/27" );
     script_set_attribute(attribute:"see_also", value:"https://seclists.org/bugtraq/2008/Feb/34" );
     script_set_attribute(attribute:"solution", value:
    "Upgrade to SAPlpd version 6.29 or later by updating to SAP GUI for
    Windows version 7.10 Patchlevel 6 / 6.30 Patchlevel 30 / 6.20
    Patchlevel 72 or later." );
     script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
     script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
     script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
     script_set_attribute(attribute:"exploit_available", value:"true");
     script_set_attribute(attribute:"exploit_framework_core", value:"true");
     script_set_attribute(attribute:"metasploit_name", value:'SAP SAPLPD 6.28 Buffer Overflow');
     script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
     script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
     script_set_attribute(attribute:"canvas_package", value:'D2ExploitPack');
     script_cwe_id(119);
     script_set_attribute(attribute:"plugin_publication_date", value: "2008/02/20");
     script_cvs_date("Date: 2018/11/15 20:50:24");
    script_set_attribute(attribute:"plugin_type", value:"remote");
    script_set_attribute(attribute:"cpe",value:"cpe:/a:sap:saplpd");
    script_set_attribute(attribute:"cpe",value:"cpe:/a:sap:sapgui");
    script_end_attributes();
    
     
      script_category(ACT_GATHER_INFO);
      script_family(english:"Misc.");
    
      script_copyright(english:"This script is Copyright (C) 2008-2018 Tenable Network Security, Inc.");
    
      script_dependencies("lpd_detect.nasl");
      script_require_ports("Services/lpd", 515);
    
      exit(0);
    }
    
    
    include("byte_func.inc");
    include("global_settings.inc");
    
    
    port = get_kb_item("Services/lpd");
    if (!port) port = 515;
    if (!get_port_state(port)) exit(0);
    
    
    # Establish a connection.
    soc = open_sock_tcp(port);
    if (!soc) exit(0);
    
    
    # Query its version number.
    req = mkbyte(4) + mkbyte(12) + 'TOB' + '\n';
    send(socket:soc, data:req);
    res = recv_line(socket:soc, length:1024);
    close(soc);
    
    if (strlen(res) && "This is SAPLPD (Version " >< res)
    {
      version = strstr(res, "SAPLPD (Version ") - "SAPLPD (Version ";
      if (version) version = version - strstr(version, ")");
    
      if (version =~ "^[0-9][0-9.]+[0-9]$")
      {
        ver = split(version, sep:'.', keep:FALSE);
        for (i=0; i<max_index(ver); i++)
          ver[i] = int(ver[i]);
    
        # There's a problem if it's before 6.29.
        if (
          ver[0] < 6 ||
          (ver[0] == 6 && ver[1] < 29)
        )
        {
          if (report_verbosity)
          {
            report = string(
              "\n",
              "The remote LPD daemon identifies itself as :\n",
              "\n",
              "  ", res, "\n"
            );
            security_hole(port:port, extra:report);
          }
          else security_hole(port);
        }
      }
    }
    
  • NASL familyWindows
    NASL idSAPLPD_6_29_CREDS.NASL
    descriptionSAP GUI is installed on the remote host. It is the GUI client component used with SAP ERP / SAP R/3 enterprise resource planning software. The installation of SAP GUI on the remote host includes a print server, SAPlpd, that is affected by several denial of service and buffer overflow vulnerabilities. An unauthenticated, remote attacker can leverage these issues to crash the affected service or to execute arbitrary code on the affected host subject to the privileges under which it operates.
    last seen2020-06-01
    modified2020-06-02
    plugin id31122
    published2008-02-20
    reporterThis script is Copyright (C) 2008-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/31122
    titleSAPlpd < 6.29 Multiple Vulnerabilities (credentialed check)
    code
    #
    #  (C) Tenable Network Security, Inc.
    #
    
    
    
    include("compat.inc");
    
    if (description)
    {
      script_id(31122);
      script_version("1.14");
     script_cvs_date("Date: 2018/11/15 20:50:28");
    
      script_cve_id("CVE-2008-0620", "CVE-2008-0621");
      script_bugtraq_id(27613);
      script_xref(name:"Secunia", value:"28786");
    
      script_name(english:"SAPlpd < 6.29 Multiple Vulnerabilities (credentialed check)");
      script_summary(english:"Checks version of SAPlpd.exe");
    
     script_set_attribute(attribute:"synopsis", value:
    "The remote Windows host contains a program affected by multiple
    vulnerabilities.");
     script_set_attribute(attribute:"description", value:
    "SAP GUI is installed on the remote host. It is the GUI client
    component used with SAP ERP / SAP R/3 enterprise resource planning
    software.
    
    The installation of SAP GUI on the remote host includes a print
    server, SAPlpd, that is affected by several denial of service and
    buffer overflow vulnerabilities. An unauthenticated, remote attacker
    can leverage these issues to crash the affected service or to execute
    arbitrary code on the affected host subject to the privileges under
    which it operates.");
     script_set_attribute(attribute:"see_also", value:"http://aluigi.altervista.org/adv/saplpdz-adv.txt");
     script_set_attribute(attribute:"see_also", value:"https://seclists.org/bugtraq/2008/Feb/27" );
     script_set_attribute(attribute:"see_also", value:"https://seclists.org/bugtraq/2008/Feb/34" );
     script_set_attribute(attribute:"solution", value:
    "Upgrade to SAPlpd version 6.29 or later by updating to SAP GUI for
    Windows version 7.10 Patchlevel 6 / 6.30 Patchlevel 30 / 6.20
    Patchlevel 72 or later.");
     script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
     script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
     script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
     script_set_attribute(attribute:"exploit_available", value:"true");
     script_set_attribute(attribute:"exploit_framework_core", value:"true");
     script_set_attribute(attribute:"metasploit_name", value:'SAP SAPLPD 6.28 Buffer Overflow');
     script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");
     script_set_attribute(attribute:"exploit_framework_canvas", value:"true");
     script_set_attribute(attribute:"canvas_package", value:'D2ExploitPack');
     script_cwe_id(119);
    
     script_set_attribute(attribute:"plugin_publication_date", value:"2008/02/20");
    
    script_set_attribute(attribute:"plugin_type", value:"local");
    script_set_attribute(attribute:"cpe", value:"cpe:/a:sap:saplpd");
    script_set_attribute(attribute:"cpe",value:"cpe:/a:sap:sapgui");
    script_end_attributes();
    
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2008-2018 Tenable Network Security, Inc.");
    
      script_dependencies("smb_hotfixes.nasl");
      script_require_keys("SMB/Registry/Enumerated");
      script_require_ports(139, 445);
    
      exit(0);
    }
    
    
    include("global_settings.inc");
    include("smb_func.inc");
    include("audit.inc");
    
    
    if (!get_kb_item("SMB/Registry/Enumerated")) exit(0);
    
    
    # Connect to the appropriate share.
    name    =  kb_smb_name();
    port    =  kb_smb_transport();
    
    login   =  kb_smb_login();
    pass    =  kb_smb_password();
    domain  =  kb_smb_domain();
    
    
    
    if(! smb_session_init()) audit(AUDIT_FN_FAIL, 'smb_session_init');
    rc = NetUseAdd(login:login, password:pass, domain:domain, share:"IPC$");
    if (rc != 1) {
      NetUseDel();
      exit(0);
    }
    
    
    # Connect to remote registry.
    hklm = RegConnectRegistry(hkey:HKEY_LOCAL_MACHINE);
    if (isnull(hklm))
    {
      NetUseDel();
      exit(0);
    }
    
    
    # Make sure it's installed.
    path = NULL;
    
    key = "SOFTWARE\SAP\SAP Shared";
    key_h = RegOpenKey(handle:hklm, key:key, mode:MAXIMUM_ALLOWED);
    if (!isnull(key_h))
    {
      value = RegQueryValue(handle:key_h, item:"SAPsysdir");
      if (!isnull(value)) path = value[1];
      RegCloseKey(handle:key_h);
    }
    RegCloseKey(handle:hklm);
    if (isnull(path))
    {
      NetUseDel();
      exit(0);
    }
    
    
    # Determine the version of .
    share = ereg_replace(pattern:"^([A-Za-z]):.*", replace:"\1$", string:path);
    exe = ereg_replace(pattern:"^[A-Za-z]:(.*)", replace:"\1\SAPlpd\SAPlpd.exe", string:path);
    NetUseDel(close:FALSE);
    
    rc = NetUseAdd(login:login, password:pass, domain:domain, share:share);
    if (rc != 1)
    {
      NetUseDel();
      exit(0);
    }
    
    fh = CreateFile(
      file:exe,
      desired_access:GENERIC_READ,
      file_attributes:FILE_ATTRIBUTE_NORMAL,
      share_mode:FILE_SHARE_READ,
      create_disposition:OPEN_EXISTING
    );
    ver = NULL;
    if (!isnull(fh))
    {
      ver = GetFileVersion(handle:fh);
      CloseFile(handle:fh);
    }
    NetUseDel();
    
    
    # Check the version number.
    if (!isnull(ver))
    {
      fix = split("6.29", sep:'.', keep:FALSE);
      for (i=0; i<max_index(fix); i++)
        fix[i] = int(fix[i]);
    
      for (i=0; i<max_index(ver); i++)
        if ((ver[i] < fix[i]))
        {
          if (report_verbosity)
          {
            version = string(ver[0], ".", ver[1]);
            report = string(
              "\n",
              "Version ", version, " of SAPlpd is installed under :\n",
              "\n",
              "  ", path, "\\SAPlpd\n"
            );
            security_hole(port:port, extra:report);
          }
          else security_hole(port);
          break;
        }
        else if (ver[i] > fix[i])
          break;
    }
    

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/83081/saplpd.rb.txt
idPACKETSTORM:83081
last seen2016-12-05
published2009-11-26
reporterMC
sourcehttps://packetstormsecurity.com/files/83081/SAP-SAPLPD-6.28-Buffer-Overflow.html
titleSAP SAPLPD 6.28 Buffer Overflow

Seebug

bulletinFamilyexploit
descriptionBUGTRAQ ID: 27613 CVE(CAN) ID: CVE-2008-0620,CVE-2008-0621 SAPlpd是SAP GUI软件包中所捆绑的Windows平台行市打印机守护程序。 SAPLPD服务程序在处理LPD命令时存在多个缓冲区溢出漏洞,远程攻击者可能利用这些漏洞控制服务器或导致服务不可用。 如果向0x01、0x02、0x03、0x04、0x05、0x31、0x32、0x33、0x34和0x35 LPD命令传送了超长参数的话,就可以触发这些溢出,导致执行任意指令;如果向0x53 LPD命令传送了畸形参数,还可能导致服务器终止。 SAP SAPlpd &lt;= 6.28 SAP SAPSprint 1018 SAP GUI for Windows 7.10 SAP GUI for Windows 6.40 Patchlevel 29 厂商补丁: SAP --- 目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载: <a href=http://www.sap.com/ target=_blank>http://www.sap.com/</a>
idSSV:2947
last seen2017-11-19
modified2008-02-26
published2008-02-26
reporterRoot
sourcehttps://www.seebug.org/vuldb/ssvid-2947
titleSAPlpd多个远程溢出及拒绝服务漏洞