Critical flaw found in SAP software
The ACSC has warned of a critical flaw in SAP software that could potentially allow attackers to take control of trusted SAP applications.
The critical vulnerability in the Java component LM Configuration Wizard within the SAP Netweaver Application Survey was uncovered by security firm Onapsis.
The vulnerability can be exploited remotely over HTTP without the need of a username or password. Due to these characteristics, it has been given the highest possible score of 10 on the Common Vulnerability Scoring System.
Once attackers have gained control, they would be able to read, modify or delete every database record or file in the system, according to Onapsis.
“Because of the type of unrestricted access an attacker would obtain by exploiting unpatched systems, this vulnerability also may constitute a deficiency in an enterprise’s IT controls for regulatory mandates,” the company said.
SAP has issued security patches for the vulnerability, which the ACSC urges uses of the products to implement as soon as possible.
Potentially vulnerable SAP solutions include all SAP Java-based solutions, including its popular ERP, CRM and supply chain management software. Onapsis estimates that as many as 40,000 SAP customers worldwide might be affected by the bug.
As a mitigation measure, the ACSC is recommending that organisations unable to immediately apply the patches disable the LM Configuration Wizard service.
If this cannot be completed immediately, the ACSC recommends organisations monitor SAP Netweaver systems and logs for any unusual activities.
Phishing attacks on Australian workers growing more successful
The rate of Australian workers clicking on phishing links has surged 140% since last year,...
Ingram Micro adds AlgoSec to supplier line-up
Ingram Micro has reached an agreement to distribute application-centric security...
CyberCX to be bought out by Accenture
Accenture has arranged to make its largest cybersecurity acquisition to date through the purchase...
