This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enig3D525CA88DFD75373E5E465F
Content-Type: multipart/mixed;
boundary="------------040609080206030402080604"

This is a multi-part message in MIME format.
--------------040609080206030402080604
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable


-----------------------------------------
Mariano Nu=F1ez Di Croce

CYBSEC S.A. Security Systems
Email: mnunez@cybsec.com
Tel/Fax: (54-11) 4371-4444
Web: http://www.cybsec.com
PGP: http://www.cybsec.com/pgp/mnunez.txt
-----------------------------------------
(The following pre-advisory is also available in PDF format for download =
at:
http://www.cybsec.com/vuln/CYBSEC-Se...EM_CREATE_INS=
TANCE_RFC_Function_Buffer_Overflow.pdf )


CYBSEC S.A.
www.cybsec.com

Pre-Advisory Name: SAP SYSTEM_CREATE_INSTANCE RFC Function Buffer Overflo=
w
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D

Vulnerability Class: Buffer Overflow
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D

Release Date: 2007-04-03
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

Affected Applications:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D
=2E SAP RFC Library 6.40
=2E SAP RFC Library 7.00

Affected Platforms:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D

=2E AIX 32bit
=2E AIX 64bit
=2E HP-UX on IA64 64bit
=2E HP-UX on PA-RISC 64bit
=2E Linux on IA32 32bit
=2E Linux on IA64 64bit
=2E Linux on Power 64bit
=2E Linux on x86_64 64bit
=2E Linux on zSeries 64bit
=2E Mac OS
=2E OS/400
=2E OS/400 V5R2M0
=2E Reliant 32bit
=2E Solaris on SPARC 32bit
=2E Solaris on SPARC 64bit
=2E Solaris on x64_64 64bit
=2E TRU64 64bit
=2E Windows Server on IA32 32bit
=2E Windows Server on IA64 64bit
=2E Windows Server on x64 64bit
=2E z/OS 32bit

Local / Remote: Remote
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

Severity: High
=3D=3D=3D=3D=3D=3D=3D=3D=3D

Author: Mariano Nu=F1ez Di Croce
=3D=3D=3D=3D=3D=3D=3D

Vendor Status: Confirmed. Updates Released.
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

Reference to Vulnerability Disclosure Policy: http://www.cybsec.com/vulne=
rability_policy.pdf
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D

Product Overview:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D

"The RFC Library offers an interface to a SAP System. The RFC Library is =
the most commonly used and installed component of existing SAP Software. =
This
interface provides the opportunity to call any RFC Function in a SAP Syst=
em from an external application. Moreover, the RFC Library offers the
possibility to write a RFC Server Program, which is accessible from any S=
AP System or external application. Most SAP Connectors use the RFC Librar=
y as
communication platform to SAP Systems."

SYSTEM_CREATE_INSTANCE RFC Function allows the creation of remote objects=
, where some object adapter is available. This function is installed by
default in every external RFC server.

Vulnerability Description:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D

A remote buffer overflow vulnerability has been detected in the SYSTEM_CR=
EATE_INSTANCE RFC Function.

Technical Details:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D

Technical details will be released three months after publication of this=
pre-advisory. This was agreed upon with SAP to allow their customers to
upgrade affected software prior to technical knowledge been publicly avai=
lable.

Impact:
=3D=3D=3D=3D=3D=3D=3D

This vulnerability may allow an attacker to remotely execute arbitrary co=
mmands over external RFC servers.

Solutions:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

SAP has released patches to address this vulnerability. Affected customer=
s should apply the patches immediately.
More information can be found on SAP Note 1003910.

Vendor Response:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

=2E 2006-11-21: Initial Vendor Contact.
=2E 2006-12-01: Vendor Confirmed Vulnerability.
=2E 2006-12-11: Vendor Releases Update for version 6.40.
=2E 2006-12-11: Vendor Releases Update for version 7.00.
=2E 2007-04-03: Pre-Advisory Public Disclosure.


Special Thanks:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D

Thanks goes to Victor Montero and Gustavo Kunst.

Contact Information:
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D
For more information regarding the vulnerability feel free to contact the=
author at mnunez <at> cybsec <dot> com.



About CYBSEC S.A. Security Systems
-----------------------------------

Since 1996 CYBSEC S.A. is devoted exclusively to provide professional ser=
vices specialized in Computer Security. More than 150 clients around the
globe validate our quality and professionalism.
To keep objectivity, CYBSEC S.A. does not represent, neither sell, nor is=
associated with other software and/or hardware provider companies.
Our services are strictly focused on Information Security, protecting our=
clients from emerging security threats, mantaining their IT deployments
available, safe, and reliable.
Beyond professional services, CYBSEC is continuosly researching new defen=
se and attack techiniques and contributing with the security community wi=
th
high quality information exchange.
=09
For more information, please visit www.cybsec.com









--------------040609080206030402080604
Content-Type: application/pgp-signature;
name="signature.asc"
Content-Transfer-Encoding: base64
Content-Disposition: inline;
filename="signature.asc"

LS0tLS1CRUdJTiBQR1AgU0lHTkFUVVJFLS0tLS0KVmVyc2lvbj ogR251UEcgdjEuNC42IChH
TlUvTGludXgpCgppRDhEQlFGR0U1MWF2V1Bld3ZtZHJTZ1JBcD c3QUtDQy84M0todHA0akUz
Mm16MitQUFZPL3hrS0FRQ2VJLzN4CmRPOUNMZmJvWi8rZGJwRn pqTnUzT1FJPQo9RDRwOAot
LS0tLUVORCBQR1AgU0lHTkFUVVJFLS0tLS0KCg==
--------------040609080206030402080604
Content-Type: application/pgp-signature;
name="signature.asc"
Content-Transfer-Encoding: base64
Content-Disposition: inline;
filename="signature.asc"

LS0tLS1CRUdJTiBQR1AgU0lHTkFUVVJFLS0tLS0KVmVyc2lvbj ogR251UEcgdjEuNC42IChH
TlUvTGludXgpCgppRDhEQlFGR0U1MzZ2V1Bld3ZtZHJTZ1JBaV I3QUo5VFFjc3BJQWdLRFpu
eVptZUVjcjRpNk8wYXNBQ2doMzhwCnMvaVNFTzc3MUx4azR6dj JjTHMrM1FJPQo9aDhSSQot
LS0tLUVORCBQR1AgU0lHTkFUVVJFLS0tLS0KCg==
--------------040609080206030402080604
Content-Type: application/pgp-signature;
name="signature.asc"
Content-Transfer-Encoding: base64
Content-Disposition: inline;
filename="signature.asc"

LS0tLS1CRUdJTiBQR1AgU0lHTkFUVVJFLS0tLS0KVmVyc2lvbj ogR251UEcgdjEuNC42IChH
TlUvTGludXgpCgppRDhEQlFGR0U1NUZ2V1Bld3ZtZHJTZ1JBZz lVQUowZENSeXQ1RVhNTnFx
ZzlSN1h4RzFtVHIrdzJRQ2ZRRkNxCkxFcTZFcFhUT3RFb2xGMF NXbmRmL3k4PQo9enB4cQot
LS0tLUVORCBQR1AgU0lHTkFUVVJFLS0tLS0KCg==
--------------040609080206030402080604--

--------------enig3D525CA88DFD75373E5E465F
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFGE56PvWPewvmdrSgRAlNzAJ0Z2QJ4jTgEGF9IQQTAi+ dQvDbhWwCfbhNl
4c8pnMegYpk4Vf8daVtC4qQ=
=lt61
-----END PGP SIGNATURE-----

--------------enig3D525CA88DFD75373E5E465F--