SAP, MySQL patch critical database flaw |
 |
By SearchSAP.com Staff
31 Aug 2006 | SearchSAP.com |
|
|
Developers have corrected a flaw in the SAP MaxDB database that could be targeted by hackers to execute arbitrary code.
Researcher Oliver Karow of Symantec is credited with finding the database vulnerability. The flaw was fixed in the latest version of MaxDB 7.6.00.31.
"It is possible to execute arbitrary code with the privileges of the 'wahttp' process by sending a malformed HTTP request. Authentication is not required for successful exploitation to occur," according to a security advisory issued by Symantec.
As a temporary workaround, MaxDB customers can disable the SAP-DB WWW Service or restrict access to it, according to Symantec. SAP customers can download the latest version at www.service.sap.com.
In 2004, SAP entered into an agreement with open source database maker MySQL to cross-license SAP DB. The open source database was then rebranded MaxDB. It is optimized to run in conjunction with the mySAP Business Suite and the MySQL database management system.
|
