[NT] Internet Communication Manager Denial Of Service Attack

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

Internet Communication Manager Denial Of Service Attack
------------------------------------------------------------------------

SUMMARY

Internet Communication Manager "ensures communication between the SAP Web
Application Server with the WWW using the HTTP, HTTPS and SMTP protocols.
ICM is part of the SAP Web Application Server and is implemented as an
independent process (ICMAN.exe) and is started and monitored by the
dispatcher".

A vulnerability within SAP's Internet Communication Manager allows remote
attackers to cause the program to crash by sending it an overly long
request.

DETAILS

The Internet Communication Manager also offers the ICM Server Cache as
part of its functionality, using the ICM server cache increases
performance considerably. The ICM server cache (also known as the Internet
Server Cache saves HTTP(S) objects before they are sent back to the
requesting client. The next time an object is requested, the application
gets the contents directly from the cache before sending it to the client.

However, it is possible to configure the Web dispatcher to act as a web
cache. For more information visit

<http://help.sap.com/saphelp_nw04s/helpdata/en/9f/89e2edfde645fca1636fa8468d2e74/content.htm> http://help.sap.com/saphelp_nw04s/helpdata/en/9f/89e2edfde645fca1636fa8468d2e74/content.htm.

A method by which to determine if the Internet Communication Manager is
acting as the web cache, we can make the following request:
http://target/foo.gif?sap-isc-key=ngs

An error will be returned:

500 Internal Server Error

___________________________________________________________

Error: -15
Version: 7010
Component: HTTP_CACHE
Date/Time: xxxxxxxxxxxxxxxx
Module: http_cache.c
Line: 2640
Server: Target_JP1_01
Error Tag: {-}
Detail: Object not found (key='ngs')

Technical Details:
By passing a URI of 264 bytes the ICMAN.exe process terminates. This
includes the length of the requested file, the file extension, the ?, the
parameter 'sap-isc-key=' and the value.

This is an very effective Denial of Service attack within a SAP
environment.

ADDITIONAL INFORMATION

The information has been provided by <mailto:mark@ngssoftware.com> Mark
Litchfield.

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.