4 ms·
Critical SAP Bug Allows Full Enterprise System Takeover
- igetspam 6y agoSAP is garbage at security. I worked there for a month, after a acquisition. In that time, I was given access to a system to control a cloud fleet, as a demo. That was five years ago. I contacted them half a dozen times and told them I still had access. I've reached out to multiple personal contacts, who brought it up with IT and security. I check every few months. I can still nuke or hijack that cloud today.
- yabones 6y agoMore info from the CISA bulletin: https://us-cert.cisa.gov/ncas/alerts/aa20-195a https://us-cert.cisa.gov/ncas/alerts/aa20-195a Also some on the SAP wiki: https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=552599675 https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=5... Unfortunately, most of it appears to be locked behind a sign-in.
- tourist_on_road 6y agoThe irony
- bt1a 6y agoGood luck updating that pile of dinosaur bones!
- agustif 6y agoNobody will get fired for buying IBM...
- janwillemb 6y agoArticle has a lot of words. Summary: A vulnerability in SAP Netweaver Java allows an unauthenticated attacker to create a new SAP user with maximum privileges, bypassing all access and authorization controls
- zurfer 6y agorecently there was a list on HN that estimated prices for exploits. I wonder how much this exploit would cost?
- A_No_Name_Mouse 6y ago$25k-$50k now that a patch is available, according to https://vuldb.com/?id.157874 https://vuldb.com/?id.157874
- FDSGSG 6y agovuldb numbers are bullshit though
- kfarr 6y agoI feel like there's a joke somewhere in this, SAP takes over your whole enterprise if you let it?