CVE-2007-3614
published 2007-07-06CVE-2007-3614: Multiple stack-based buffer overflows in waHTTP.exe (aka the SAP DB Web Server) in SAP DB, possibly 7.3 through 7.5, allow remote attackers to execute…
PriorityP265high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
70.00%
99.3th percentile
Multiple stack-based buffer overflows in waHTTP.exe (aka the SAP DB Web Server) in SAP DB, possibly 7.3 through 7.5, allow remote attackers to execute arbitrary code via (1) a certain cookie value; (2) a certain additional parameter, related to sapdbwa_GetQueryString; and other unspecified vectors related to "numerous other fields."
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sap | sap_db | — | — |
| sap | sap_db | — | — |
| sap | sap_db | — | — |
| sap | sap_db | — | — |
| sap | sap_db | — | — |
| sap | sap_db | — | — |
| sap | sap_db | — | — |
| sap | sap_db | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff (PrependEncoder / shellcode stub)
bytes↗
\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x37\x49... (win32_bind shellcode Alpha2 encoded, port 4444)
- →Exploit sends an overly long GET request (~20774+ bytes) to /webdbm with query parameters Event=DBM_INTERN_TEST&Action=REFRESH&HTTP_COOKIE= to trigger the SEH overwrite stack buffer overflow. ↗
- →Detect HTTP GET requests to /webdbm containing the query string parameters Event=DBM_INTERN_TEST&Action=REFRESH&HTTP_COOKIE= with an abnormally large value (>20000 bytes) on port 9999. ↗
- →The exploit payload uses AlphanumUpper encoding with ECX as the BufferRegister; look for large alphanumeric-only payloads in HTTP_COOKIE query parameter values. ↗
- →Fingerprint the SAP DB Web Server by its Server response header banner SAP-Internet-SapDb-Server/ to identify exposed instances. ↗
- →The vulnerability is in waHTTP.exe (SAP DB Web Server); monitor for abnormal process behavior or crashes of this process, especially when receiving large HTTP requests. ↗
- ·The Metasploit module RET address (0x1003c95a) targets wapi.dll version 7.4.3.0 specifically; the standalone exploit uses a different RET address (0x1003a218) for the same DLL version, suggesting minor version differences affect offsets. ↗
- ·The CVE affects SAP DB possibly versions 7.3 through 7.5; exploitation details in public PoCs are specifically demonstrated against version 7.4 on Windows 2000. ↗
- ·The vulnerability covers multiple attack vectors: a cookie value, a query string parameter (sapdbwa_GetQueryString), and numerous other unspecified fields — detection rules should not be limited to the HTTP_COOKIE vector alone. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
SAP DB 7.4 - WebTools Buffer Overflow (Metasploit)
exploitdb·2010-07-16
CVE-2007-3614 SAP DB 7.4 - WebTools Buffer Overflow (Metasploit)
SAP DB 7.4 - WebTools Buffer Overflow (Metasploit)
---
##
# $Id: sapdb_webtools.rb 9842 2010-07-16 02:33:25Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 [ /SAP-Internet-SapDb-Server\// ] }
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::Remote::Seh
def initialize(info = {})
super(update_info(info,
'Name' => 'SAP DB 7.4 WebTools Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in SAP DB 7.4 WebTools.
By sending an overly long GET request, it may be possible for
an attacker to exe
Exploit-DB
SAP DB 7.4 - WebTools Remote Overwrite (SEH)
exploitdb·2007-07-07
CVE-2007-3614 SAP DB 7.4 - WebTools Remote Overwrite (SEH)
SAP DB 7.4 - WebTools Remote Overwrite (SEH)
---
/* Dreatica-FXP crew
*
* ----------------------------------------
* Target : SAP DB 7.4 WebTools
* Site : http://www.sapdb.org
* Found by : NGSSoftware Insight Security Research
* ----------------------------------------
* Exploit : SAP DB 7.4 WebTools Remote SEH overwrite exploit
* Exploit date : 07.07.2007
* Exploit writer : Heretic2 ([email protected])
* OS : Windows 2000 ALL SP
* Crew : Dreatica-FXP
* ----------------------------------------
* Info : This is the SEH overwrite realization of the vulnerability found by
* NGSSoftware Insight Security Research, it is trivial. We send a big amount
* of bytes to server (about 20000) and overwrite SEH. Aproximatly at the 9900
* byte we trigger an exception and our shellcode is executed.
* -
Exploit-DB
SAP DB 7.x Web Server - 'WAHTTP.exe' Multiple Buffer Overflow Vulnerabilities
exploitdb·2007-07-05
CVE-2007-3614 SAP DB 7.x Web Server - 'WAHTTP.exe' Multiple Buffer Overflow Vulnerabilities
SAP DB 7.x Web Server - 'WAHTTP.exe' Multiple Buffer Overflow Vulnerabilities
---
// source: https://www.securityfocus.com/bid/24773/info
SAP DB Web Server is prone to multiple buffer-overflow vulnerabilities because it fails to adequately bounds-check user-supplied input before copying it to an insufficiently sized buffer.
Successfully exploiting these issues will allow an attacker to execute arbitrary code with SYSTEM-level privileges. Failed exploit attempts will result in a denial-of-service condition.
/* Dreatica-FXP crew
*
* ----------------------------------------
* Target : SAP DB 7.4 WebTools
* Site : http://www.sapdb.org
* Found by : NGSSoftware Insight Security Research
* ----------------------------------------
* Exploit : SAP DB 7.4 WebTools Remote SEH overwrite exploit
*
Metasploit
SAP DB 7.4 WebTools Buffer Overflow
metasploit
SAP DB 7.4 WebTools Buffer Overflow
SAP DB 7.4 WebTools Buffer Overflow
This module exploits a stack buffer overflow in SAP DB 7.4 WebTools. By sending an overly long GET request, it may be possible for an attacker to execute arbitrary code.
No writeups or analysis indexed.
http://osvdb.org/37838http://secunia.com/advisories/25954http://securityreason.com/securityalert/2867http://www.kb.cert.org/vuls/id/679041http://www.ngssoftware.com/advisories/critical-risk-vulnerability-in-sap-db-web-server-stack-overflow/http://www.securityfocus.com/archive/1/472891/100/0/threadedhttp://www.securityfocus.com/bid/24773http://www.securitytracker.com/id?1018341http://www.vupen.com/english/advisories/2007/2453https://exchange.xforce.ibmcloud.com/vulnerabilities/35277http://osvdb.org/37838http://secunia.com/advisories/25954http://securityreason.com/securityalert/2867http://www.kb.cert.org/vuls/id/679041http://www.ngssoftware.com/advisories/critical-risk-vulnerability-in-sap-db-web-server-stack-overflow/http://www.securityfocus.com/archive/1/472891/100/0/threadedhttp://www.securityfocus.com/bid/24773http://www.securitytracker.com/id?1018341http://www.vupen.com/english/advisories/2007/2453https://exchange.xforce.ibmcloud.com/vulnerabilities/35277
2007-07-06
Published