CVE-2007-4475
published 2009-04-01CVE-2007-4475: Stack-based buffer overflow in EAI WebViewer3D ActiveX control (webviewer3d.dll) in SAP AG SAPgui before 7.10 Patch Level 9 allows remote attackers to execute…
PriorityP357critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
40.31%
98.6th percentile
Stack-based buffer overflow in EAI WebViewer3D ActiveX control (webviewer3d.dll) in SAP AG SAPgui before 7.10 Patch Level 9 allows remote attackers to execute arbitrary code via a long argument to the SaveViewToSessionFile method.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sap | sapgui | <= 7.10 | — |
| sap | sapgui | — | — |
| sap | sapgui | — | — |
| sap | sapgui | — | — |
| sap | sapgui | — | — |
| sap | sapgui | — | — |
| sap | sapgui | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor ActiveX method calls to SaveViewToSessionFile() on webviewer3d.dll with abnormally long string arguments, indicative of stack-based buffer overflow exploitation attempts. ↗
- →A public Metasploit module (sapgui_saveviewtosessionfile.rb) exists for this vulnerability targeting Windows XP SP0-SP3 and Windows Vista with IE 6.0 SP0-SP2 and IE 7; browser-based exploit delivery should be monitored. ↗
- →The exploit uses unescape() shellcode delivery via JavaScript in a browser context; detect large unescape() calls in HTML pages served to clients running SAPgui. ↗
- →The Metasploit module sets EXITFUNC to 'process' and uses a payload space of 1024 bytes with null byte as the only bad character; tune shellcode detection signatures accordingly. ↗
- ·The vulnerability affects SAPgui versions before 7.10 Patch Level 9 only; patched installations are not vulnerable. ↗
- ·Doc 2 (Exploit-DB 32879) is unrelated to CVE-2007-4475 and covers SAP MaxDB XSS vulnerabilities; its IOCs should not be attributed to this CVE. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
SAP AG SAPgui EAI WebViewer3D - Remote Buffer Overflow (Metasploit)
exploitdb·2010-05-09
CVE-2007-4475 SAP AG SAPgui EAI WebViewer3D - Remote Buffer Overflow (Metasploit)
SAP AG SAPgui EAI WebViewer3D - Remote Buffer Overflow (Metasploit)
---
##
# $Id: sapgui_saveviewtosessionfile.rb 9262 2010-05-09 17:45:00Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'SAP AG SAPgui EAI WebViewer3D Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in Siemens Unigraphics Solutions
Teamcenter Visualization EAI WebViewer3D ActiveX control that is bundled
with SAPgui. When passing an overly long string the SaveViewToSessionFile()
method, arbitrary code may be executed.
},
'License' =
Exploit-DB
SAP MaxDB 7.4/7.6 - 'webdbm' Multiple Cross-Site Scripting Vulnerabilities
exploitdb·2009-03-31
CVE-2007-4475 SAP MaxDB 7.4/7.6 - 'webdbm' Multiple Cross-Site Scripting Vulnerabilities
SAP MaxDB 7.4/7.6 - 'webdbm' Multiple Cross-Site Scripting Vulnerabilities
---
source: https://www.securityfocus.com/bid/34319/info
SAP MaxDB is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
http://example.com:9999/webdbm?Event=DBM_LOGON&Action=VIEW&Server=&Database=[XSS]
http://example.com:9999/webdbm?Event=DBM_LOGON&Action=VIEW&Server=&User=[XSS]
http://example.com:9999/webdbm?Event=DBM_LOGON&Action=VIEW&Server=&Database=&User=&Password=[XSS]
Metasploit
SAP AG SAPgui EAI WebViewer3D Buffer Overflow
metasploit
SAP AG SAPgui EAI WebViewer3D Buffer Overflow
SAP AG SAPgui EAI WebViewer3D Buffer Overflow
This module exploits a stack buffer overflow in Siemens Unigraphics Solutions Teamcenter Visualization EAI WebViewer3D ActiveX control that is bundled with SAPgui. When passing an overly long string the SaveViewToSessionFile() method, arbitrary code may be executed.
No writeups or analysis indexed.
http://secunia.com/advisories/34559http://www.kb.cert.org/vuls/id/985449http://www.securityfocus.com/bid/34310http://www.vupen.com/english/advisories/2009/0892https://exchange.xforce.ibmcloud.com/vulnerabilities/49543https://service.sap.com/sap/support/notes/1153794http://secunia.com/advisories/34559http://www.kb.cert.org/vuls/id/985449http://www.securityfocus.com/bid/34310http://www.vupen.com/english/advisories/2009/0892https://exchange.xforce.ibmcloud.com/vulnerabilities/49543https://service.sap.com/sap/support/notes/1153794
2009-04-01
Published