SAP fixed four flaws rated 10.0, the top severity score, that attackers can exploit without a password. Companies running SAP should patch soon.
SAP has released fixes for four security flaws that it rates 10.0, the highest score on the standard severity scale. An attacker does not need to log in to use any of them, and none requires a user to click anything. The fixes came out on SAP's monthly Security Patch Day in November.
Three of the flaws are in SAP NetWeaver, the application server that SAP systems run on. The fourth is in the Web Dispatcher, which takes web requests from the internet and passes them to that server. Each flaw has its own fix, and the affected versions differ by component.
SAP software often sits at the center of a company's finance, HR and supply operations. SAP says a full compromise could follow from the sign-in flaw, possibly reaching connected systems. The two code-running flaws could also hand over the whole system. The Gateway flaw lets an attacker take unauthorized actions inside the SAP environment.
A different SAML flaw in the same software, fixed on June 9, needed an attacker who already had a normal user account. This new one does not.
The risk is for companies that run SAP NetWeaver application servers, the Web Dispatcher, SAP Gateway, or SAML 2.0 single sign-on. A business that does not use SAP has nothing to do. If you are not sure whether your company is affected, ask whoever manages your SAP systems.
The steps are in the alert box above. SAP strongly recommends applying these fixes as a priority. The notes sit in SAP for Me, which requires a sign-in, so your administrator or IT provider will need to retrieve them.
RedRays, a company that reviewed the notes, advises updating the kernel and all Web Dispatchers in one rollout. That would cover all 17 of this month's kernel and Web Dispatcher fixes. The material does not say whether attackers are already using these flaws. With scores this high and no login needed, waiting is a poor bet.
If your company runs SAP, ask your administrator today whether the November fixes for these four flaws have been applied.
Two healthcare organizations confirmed breaches, one involving Social Security numbers. Here is who should watch their mail and what is still unknown.
Read more: Two healthcare data breaches expose patient records, including Social Security numbersGhana's cyber security agency says fake texts using the name TraffiTech-GH are going to drivers. One wrong tap could cost you money or personal details.
Read more: Fake TraffiTech-GH texts target drivers, Ghana cyber agency warnsQueens Public Library says a ransomware attack has disrupted its network at every location. Branches are open, but renewals are down and some programs may change.
Read more: Queens Public Library hit by ransomware, network down at all branches
