[ESNC-2013-002] Privilege Escalation in SAP Production Planning and Control

Please refer to www.esnc.de for the original security advisory, updates and
additional information.
------------------------------------------------------------------------
1. Business Impact
------------------------------------------------------------------------

This vulnerability allows bypassing authority checks that exist before
executing a transaction. A transaction in SAP terminology is the execution
of a program.

By exploiting  this vulnerability, an attacker can also control the
transaction to be executed, allowing it to obtain critical rights in the
system and bypassing certain segregation of duties (SoD) restrictions.

*Risk Level: High*
------------------------------------------------------------------------
2. Advisory Information
------------------------------------------------------------------------

-- Security Advisory- ID: ESNC-2013-002
-- CVE ID: CVE-2013-3062
-- Original security advisory:
http://www.esnc.de/sap-security-audit-and-scan-services/security-advisories/38-privilege-escalation-in-sap-production-planning-and-control
-- Vendor Patch Date: 2012-06-12
-- Public Advisory Date: 2013-04-16
-- Researcher: Ertunga Arsal and Mert Suoglu
------------------------------------------------------------------------
3. Vulnerability Information
------------------------------------------------------------------------

-- Vendor: SAP
-- Affected Components: Production Planning and Control - Engineering
Workbench
-- Vulnerability Class: Privilege escalation
-- Vulnerable Function: CP_RC_TRANSACTION_CALL_BY_SET
-- CVSS v2 score by the vendor: 6.1 (AV:N/AC:L/AU:N/C:P/I:P/A:P)
-- Remotely Exploitable: Yes
-- Authentication Required: Yes
-- Additional Notes: An exploit for this vulnerability is available in ESNC
Penetration Testing Suite
------------------------------------------------------------------------
4. Solution
------------------------------------------------------------------------

Please apply the security patch [SAP Note 1537089] supplied by the vendor.
More information can be found at vendor's site:

https://service.sap.com/sap/support/notes/1537089
------------------------------------------------------------------------
About ESNC
------------------------------------------------------------------------

ESNC GmbH, Germany is a company specialized in SAP security audit, SAP
penetration testing, ABAP security review and SAP vulnerability assessment
services.

It's flagship product ESNC Security Suite is used by many large enterprises
for vulnerability scanning their SAP ABAP and Java systems, running ABAP
code security reviews, enforcing SAP security baselines and managing
compliance.

For more information about our products and services, please visit our web
page at www.esnc.de