CVE-2013-1592

published 2020-01-23

CVE-2013-1592: A Buffer Overflow vulnerability exists in the Message Server service _MsJ2EE_AddStatistics() function when sending specially crafted SAP Message Server packets…

Priority P2 73 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

A Buffer Overflow vulnerability exists in the Message Server service _MsJ2EE_AddStatistics() function when sending specially crafted SAP Message Server packets to remote TCP ports 36NN and/or 39NN in SAP NetWeaver 2004s, 7.01 SR1, 7.02 SP06, and 7.30 SP04, which could let a remote malicious user execute arbitrary code.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
sap	netweaver	—	—
sap	netweaver	—	—
sap	netweaver	—	—
sap	netweaver	—	—

Detection & IOCs extracted from sources · hover to see the quote

port 36NN (TCP)↗

port 39NN (TCP)↗

filename msg_server.exe↗

version msg_server.exe v6400.61.11.10122↗

version msg_server.exe v7010.29.15.58313↗

version msg_server.exe v7200.70.18.23869↗

version msg_server.exe v7200.201.0.0↗

process msg_server.exe↗

• → Detect exploitation attempts by monitoring for unauthenticated connections to TCP ports 36NN/39NN on SAP NetWeaver hosts sending crafted Message Server packets targeting the _MsJ2EE_AddStatistics() function with out-of-bounds serviceid values. ↗
• → Monitor for anomalous MSJ2EE_HEADER.serviceid values in Message Server traffic; a large or out-of-range serviceid causes out-of-bounds array indexing in _MsJ2EE_AddStatistics() and is a key exploit indicator. ↗
• → Alert on privilege escalation attempts via the Message Server: exploitation can overwrite the ms_admin_allowed global variable (at 0x008f17f0 in v7200.70.18.23869) to grant administrative privileges to unprivileged connections. ↗
• → The exploit uses specific flag/iflag field combinations in the Message Server packet to select memory corruption primitives; monitor for unusual flag/iflag values (e.g., iflag=0xd, iflag=0xc) in SAP Message Server protocol traffic. ↗
• → The exploit is remotely exploitable with no authentication required; any unauthenticated connection to the SAP Message Server TCP port sending crafted packets should be treated as suspicious. ↗

• · The SAP system number (NN) is variable per deployment; the actual TCP ports to monitor are 3600+NN and 3900+NN. Default system number 00 yields ports 3600 and 3900. ↗
• · The memory addresses for ms_admin_allowed (0x008f17f0) and j2ee_stat_services (0x0090b9e0) are specific to msg_server.exe v7200.70.18.23869 (SAP NetWeaver 7.02 SP06); they will differ across other vulnerable versions. ↗
• · Older versions of SAP NetWeaver beyond those listed are likely also vulnerable but were not confirmed tested by the researchers. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-120