Sponsored By

Serious Flaw Leaves SAP Users Vulnerable

The US-CERT is warning SAP users of a flaw that could make it possible for systems to succumb to remote, unauthenticated attacks.

1 Min Read

The US-CERT is warning SAP users of a flaw that could make it possible for systems to succumb to remote, unauthenticated attacks.According to US-CERT, the flaw resides within the SAPgui, SAP's software graphic user interface. More specifically, within an ActiveX control, MDrmSap within the mdrmsap.dll file. US-CERT says the MDrmSap ActiveX control contains an "unspecified" flaw that causes Internet Explorer to crash in a way that is exploitable when it tries to launch the library.

Here's the impact, from a recently published vulnerability note:

"By convincing a user to view a specially crafted HTML document (e.g., a Web page or an HTML e-mail message or attachment), an attacker may be able to execute arbitrary code with the privileges of the user. The attacker could also cause Internet Explorer (or the program using the WebBrowser control) to crash."

Fortunately, there's a patch, which is available from SAP (authentication required.)

Users unable to apply the patch, for whatever reason, also can disable the MDrmSap ActiveX control in Internet Explorer, or disable ActiveX altogether.

About the Author(s)

George V. Hulme, Contributing Writer

Contributor

An award winning writer and journalist, for more than 20 years George Hulme has written about business, technology, and IT security topics. He currently freelances for a wide range of publications, and is security blogger at InformationWeek.com.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights