SAP, MySQL patch critical database flaw

A flaw in the SAP MaxDB database could create a buffer overflow allowing a hacker to execute arbitrary code.

Developers have corrected a flaw in the SAP MaxDB database that could be targeted by hackers to execute arbitrary code.

Researcher Oliver Karow of Symantec is credited with finding the database vulnerability. The flaw was fixed in the latest version of MaxDB 7.6.00.31.

"It is possible to execute arbitrary code with the privileges of the 'wahttp' process by sending a malformed HTTP request. Authentication is not required for successful exploitation to occur," according to a security advisory issued by Symantec.

As a temporary workaround, MaxDB customers can disable the SAP-DB WWW Service or restrict access to it, according to Symantec. SAP customers can download the latest version at www.service.sap.com.

In 2004, SAP entered into an agreement with open source database maker MySQL to cross-license SAP DB. The open source database was then rebranded MaxDB. It is optimized to run in conjunction with the mySAP Business Suite and the MySQL database management system.

Dig deeper on SAP security administration

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

-ADS BY GOOGLE

SearchManufacturingERP

SearchOracle

SearchDataManagement

SearchAWS

SearchBusinessAnalytics

SearchCRM

SearchContentManagement

SearchFinancialApplications

Close