Systems Affected: SAP AG Netweaver 7.02
Category: Remote Code Execution
Author: Nico Leidecker, Context Information Security Ltd
Reported to vendor: 29th September 2011
Advisory Issued: 17th February 2012
Buffer Overflow In SAPHostControl
The SAPHostControl Service was found to be vulnerable to remote code execution via a stack based buffer overflow. By
sending a certain string to the service, attackers could cause a condition whereby they are able to inject and execute
malicious code. This code will execute with Administrator privileges.
The SAPHostControl service expects commands to be sent wrapped into SOAP messages. One of those messages has parameters
which are insecurely handled. These parameter values are copied into a static buffer on the stack via sprintf without
bounds checking. This leaves the service vulnerable to a buffer overlow which can lead to remote code execution.
SAP NetWeaver 7.02 (SAPHostControl Service)
SAP release a patch for the issue ref: 1638811.
29th September 2011 – Vendor Disclosure
12th December 2011 - Patch Released
17th February 2012 - Advisory Issued (SAP requested 3 months delay between patch release and advisory being issued)
Nico Leidecker of Context Information Security Ltd
About Context Information Security
Context Information Security is an independent security consultancy specialising in both technical security and
information assurance services.
The company was founded in 1998. Its client base has grown steadily over the years, thanks in large part to personal
recommendations from existing clients who value us as business partners. We believe our success is based on the value
our clients place on our product-agnostic, holistic approach; the way we work closely with them to develop a tailored
service; and to the independence, integrity and technical skills of our consultants.
Context are ideally placed to work with clients worldwide with offices in the UK, Australia and Germany.
The company’s client base now includes some of the most prestigious blue chip companies in the world, as well as
The best security experts need to bring a broad portfolio of skills to the job, so Context has always sought to recruit
staff with extensive business experience as well as technical expertise. Our aim is to provide effective and practical
solutions, advice and support: when we report back to clients we always communicate our findings and recommendations in
plain terms at a business level as well as in the form of an in-depth technical report.
Email: disclosure () contextis com