----------------------------------------------------------------------

Hardcore Disassembler / Reverse Engineer Wanted!

Want to work with IDA and BinDiff?
Want to write PoC's and Exploits?

Your nationality is not important.
We will get you a work permit, find an apartment, and offer a
relocation compensation package.

http://secunia.com/hardcore_disassembler_and_reverse_engineer/

----------------------------------------------------------------------

TITLE:
SAP Internet Graphics Service Two Vulnerabilities

SECUNIA ADVISORY ID:
SA21448

VERIFY ADVISORY:
http://secunia.com/advisories/21448/

CRITICAL:
Highly critical

IMPACT:
DoS, System access

WHERE:
>From remote

SOFTWARE:
SAP Internet Graphics Service (IGS) 7.x
http://secunia.com/product/11403/
SAP Internet Graphics Service (IGS) 6.x
http://secunia.com/product/11402/
SAP R/3
http://secunia.com/product/1206/

DESCRIPTION:
Mariano Nuņez Di Croce has reported two vulnerabilities in SAP
Internet Graphics Service (IGS), which can be exploited by malicious
people to cause a DoS (Denial of Service) or compromise a vulnerable
system.

1) An unspecified error can be exploited to crash the SAP IGS service
via a specially crafted HTTP request.

2) An unspecified boundary error can be exploited to cause a buffer
overflow via a specially crafted HTTP request.

Successful exploitation may allow execution of arbitrary code.

SOLUTION:
Apply patches for versions 6.40 and 7.00 (see SAP Note 968423 for
details).

PROVIDED AND/OR DISCOVERED BY:
Mariano Nuņez Di Croce, Cybsec.

ORIGINAL ADVISORY:
http://www.cybsec.com/vuln/CYBSEC-Security_Pre-Advisory_SAP_IGS_Remote_Denial_of_Service.pdf
http://www.cybsec.com/vuln/CYBSEC-Security_Pre-Advisory_SAP_IGS_Remote_Buffer_Overflow.pdf

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------