Critical SAP flaw leaves systems vulnerable to attack

Article

Critical SAP flaw leaves systems vulnerable to attack

A serious ActiveX flaw in SAP's graphical user interface (GUI) could be exploited by an attacker to gain access to critical files and sensitive data.

SAPgui is used in the company's enterprise resource planning applications. Based in Waldorf, Germany, the software vendor says it has more than 75,000 customers.

The vulnerability can be exploited remotely by an unauthenticated hacker, according to an advisory issued by the United States Computer Emergency Readiness Team (US-CERT). The flaw is in the ActiveX control, MDrmSap, which could crash Internet Explorer when handling malicious code, US-CERT said.

Danish vulnerability clearinghouse Secunia gave the

    Requires Free Membership to View

    Login

    SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

flaw a highly critical rating. To exploit the flaw, an attacker must trick a user into viewing a malicious website or email message, Secunia said.

SAP issued an update correcting the flaw. As a workaround, the vulnerable ActiveX control can be disabled in Internet Explorer by setting the appropriate kill bit, or by disabling ActiveX in the Internet Zone, US-CERT said in its advisory.