Sistemas Afectados

• SAP Business Client, Versión – 6.5
• SAP NetWeaver AS ABAP and ABAP Platform, Versions – 700,701,702,731,740,750,751,752,753,754,755,804
• SAP NetWeaver Guided Procedures (Administration Workset), Versions – 7.10, 7.20, 7.30, 7.31, 7.40, 7.50
• SAP NetWeaver AS for Java (Http Service), Versions – 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50
• SAP CRM, Versions – 700, 701, 702, 712, 713, 714
• SAP Process Integration (Enterprise Service Repository JAVA Mappings), Versions – 7.10, 7.20, 7.30, 7.31, 7.40, 7.50
• SAP NetWeaver AS ABAP and ABAP Platform, Versions – 700, 702, 730, 731, 804, 740, 750, 784, DEV
• SAP NetWeaver AS ABAP (Reconciliation Framework), Versions – 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 75A, 75B, 75B, 75C, 75D, 75E, 75F
• SAP Lumira Server, Version – 2.4
• SAP Web Dispatcher and Internet Communication Manager, Versions – KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.73, WEBDISP 7.53, 7.73, 7.77, 7.81, 7.82, 7.83, KERNEL 7.21, 7.22, 7.49, 7.53, 7.73, .77, 7.81, 7.82, 7.83
• SAP NetWeaver AS ABAP and ABAP Platform, Versions – KRNL32NUC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL32UC 7.21, 7.21EXT, 7.22, 7.22EXT, KRNL64NUC 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, KRNL64UC 8.04, 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 8.04, 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49, 7.53, 7.77, 7.81, 7.84
• SAP NetWeaver AS JAVA (Enterprise Portal), Versions – 7.10, 7.20, 7.30, 7.31, 7.40, 7.50
• SAP Business Objects Web Intelligence (BI Launchpad), Versions – 420, 430
• SAP 3D Visual Enterprise Viewer, Version – 9.0
• SAP NetWeaver AS JAVA (Administrator applications), Version – 7.50

Descripción

SAP ha liberado una serie de actualizaciones que corrigen varias vulnerabilidades de sus productos, siendo de las mas severas la posibilidad de evadir autenticaciones y la posibilidad de materializar ataques DDoS.

Referencia

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=580617506
• CVE-2021-27604
• CVE-2021-27610
• CVE-2021-33667
• CVE-2021-33670
• CVE-2021-33671
• CVE-2021-33676
• CVE-2021-33677
• CVE-2021-33678
• CVE-2021-33680
• CVE-2021-33681
• CVE-2021-33682
• CVE-2021-33683
• CVE-2021-33684
• CVE-2021-33687
• CVE-2021-33689

Solución

SAP ® recomienda aplicar las ultimas actualizaciones a sus productos para que sean aplicadas las correcciones a las vulnerabilidades antes mencionadas.