CVE-2017-16691

Severity Score

6.5

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

SAP Note Assistant tool (SAP BASIS from 7.00 to 7.02, from 7.10 to 7.11, 7.30, 7.31,7.40, from 7.50 to 7.52) supports upload of digitally signed note file of type 'SAR'. The digital signature verification is done together with the extraction of note file contained in the SAR archive. It is possible to append a tampered file to the SAR archive using SAPCAR tool and during the extraction, digital signature verification fails but the tampered file is extracted.

"La herramienta SAP Note Assistant
SAP Note Assistant tool (SAP BASIS desde la versión 7.00 hasta la 7.02; desde la versión 7.10 hasta la 7.11, 7.30, 7.31 y 7.40 y desde la versión 7.50 hasta la 7.52) es compatible con la subida de archivos note firmados digitalmente de tipo ""SAR"". La verificación de firma digital se realiza conjuntamente con la extracción del archivo note contenido en el archivo SAR. Es posible anexar un archivo falsificado al archivo SAR empleando la herramienta SAPCAR. Durante la extracción, la verificación de firma digital fracasa, pero el archivo falsificado se extrae."

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2017-11-09 CVE Reserved
2017-12-12 CVE Published
2023-05-05 EPSS Updated
2024-09-17 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-20: Improper Input Validation

CAPEC

References (2)

URL	Tag	Source
http://www.securityfocus.com/bid/101822	Third Party Advisory

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017	2018-01-04

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Sap Search vendor "Sap"		Business Application Software Integrated Solution Search vendor "Sap" for product "Business Application Software Integrated Solution"				7.00 Search vendor "Sap" for product "Business Application Software Integrated Solution" and version "7.00"		-		Affected
Sap Search vendor "Sap"		Business Application Software Integrated Solution Search vendor "Sap" for product "Business Application Software Integrated Solution"				7.01 Search vendor "Sap" for product "Business Application Software Integrated Solution" and version "7.01"		-		Affected
Sap Search vendor "Sap"		Business Application Software Integrated Solution Search vendor "Sap" for product "Business Application Software Integrated Solution"				7.02 Search vendor "Sap" for product "Business Application Software Integrated Solution" and version "7.02"		-		Affected
Sap Search vendor "Sap"		Business Application Software Integrated Solution Search vendor "Sap" for product "Business Application Software Integrated Solution"				7.10 Search vendor "Sap" for product "Business Application Software Integrated Solution" and version "7.10"		-		Affected
Sap Search vendor "Sap"		Business Application Software Integrated Solution Search vendor "Sap" for product "Business Application Software Integrated Solution"				7.11 Search vendor "Sap" for product "Business Application Software Integrated Solution" and version "7.11"		-		Affected
Sap Search vendor "Sap"		Business Application Software Integrated Solution Search vendor "Sap" for product "Business Application Software Integrated Solution"				7.30 Search vendor "Sap" for product "Business Application Software Integrated Solution" and version "7.30"		-		Affected
Sap Search vendor "Sap"		Business Application Software Integrated Solution Search vendor "Sap" for product "Business Application Software Integrated Solution"				7.31 Search vendor "Sap" for product "Business Application Software Integrated Solution" and version "7.31"		-		Affected
Sap Search vendor "Sap"		Business Application Software Integrated Solution Search vendor "Sap" for product "Business Application Software Integrated Solution"				7.40 Search vendor "Sap" for product "Business Application Software Integrated Solution" and version "7.40"		-		Affected
Sap Search vendor "Sap"		Business Application Software Integrated Solution Search vendor "Sap" for product "Business Application Software Integrated Solution"				7.50 Search vendor "Sap" for product "Business Application Software Integrated Solution" and version "7.50"		-		Affected
Sap Search vendor "Sap"		Business Application Software Integrated Solution Search vendor "Sap" for product "Business Application Software Integrated Solution"				7.51 Search vendor "Sap" for product "Business Application Software Integrated Solution" and version "7.51"		-		Affected
Sap Search vendor "Sap"		Business Application Software Integrated Solution Search vendor "Sap" for product "Business Application Software Integrated Solution"				7.52 Search vendor "Sap" for product "Business Application Software Integrated Solution" and version "7.52"		-		Affected