-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

(The following advisory is also available in PDF format for download at:
http://www.cybsec.com/vuln/CYBSEC-Security_Pre-Advisory_SAP_IGS_Remote_Denial_of_Service.pdf ) 


CYBSEC S.A.
www.cybsec.com 

Pre-Advisory Name: SAP Internet Graphics Service (IGS) Remote Denial of Service
=================
Vulnerability Class: Design Flaw
===================
Release Date: 08/10/2006
============
Affected Applications:
=====================* SAP IGS 6.40 Patchlevel <= 15
* SAP IGS 7.00 Patchlevel <= 3

Affected Platforms:
==================* AIX 64 bits
* HP-UX on IA64 64bit
* HP-UX on PA-RISC 64bit
* Linux on IA64 64bit
* Linux on Power 64bit
* Linux on x86_64 64bit
* Linux on zSeries 64bit
* OS/400 V5R2M0
* Solaris on SPARC 64bit
* TRU64 64bit

Local / Remote: Remote
==============
Severity: Medium
========
Author:  Mariano Nu=F1ez Di Croce
======
Vendor Status:
=============* Confirmed, update released.

Reference to Vulnerability Disclosure Policy:
============================================http://www.cybsec.com/vulnerability_policy.pdf 

Product Overview:
================="The IGS provides a server architecture where data from an SAP System or other sources can be used to generate graphical or non-graphical output."

It is important to note that IGS is installed and activated by default with the Web Application Server (versions >= 6.30)

Vulnerability Description:
=========================A specially crafted HTTP request can derive in the finalization of SAP IGS Service.

Technical Details:
=================Technical details will be released three months after publication of this pre-advisory. This was agreed upon with SAP to allow their customers to upgrade affected software prior to technical knowledge
been publicly available.

Impact:
======Successful exploitation of this vulnerability allows to remotely shutdown SAP IGS service.

Solutions:
=========SAP has released patches to address this vulnerability. Affected customers should apply the patches immediately.
More information can be found on SAP Note 968423.

Vendor Response:
===============* 06/02/2006: Initial Vendor Contact.
* 06/09/2006: Vendor Confirmed Vulnerability.
* 07/03/2006: Vendor Releases Update for version 6.40.
* 07/13/2006: Vendor Releases Update for version 7.00.
* 08/10/2006: Pre-Advisory Public Disclosure.

Special Thanks:
==============Thanks goes to Carlos Diaz and Victor Montero.

Contact Information:
===================For more information regarding the vulnerability feel free to contact the author at mnunez {at} cybsec.com. Please bear in mind that technical details will be disclosed to the general public three
months after the release of this pre-advisory.


For more information regarding CYBSEC: www.cybsec.com 
(c) 2006 - CYBSEC S.A. Security Systems
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)

iD8DBQFE237ibbZGNCayCJkRAtwiAKCcrabY31w6WuNDEKKeduFjqVYXzwCdHzvX
jRGCfJtxedojYXV3gS/y6rg=amVH
-----END PGP SIGNATURE-----