News Stay informed about the latest enterprise technology news and product updates.

SAP, MySQL patch critical database flaw

A flaw in the SAP MaxDB database could create a buffer overflow allowing a hacker to execute arbitrary code.

Developers have corrected a flaw in the SAP MaxDB database that could be targeted by hackers to execute arbitrary code.

Researcher Oliver Karow of Symantec is credited with finding the database vulnerability. The flaw was fixed in the latest version of MaxDB

"It is possible to execute arbitrary code with the privileges of the 'wahttp' process by sending a malformed HTTP request. Authentication is not required for successful exploitation to occur," according to a security advisory issued by Symantec.

As a temporary workaround, MaxDB customers can disable the SAP-DB WWW Service or restrict access to it, according to Symantec. SAP customers can download the latest version at

In 2004, SAP entered into an agreement with open source database maker MySQL to cross-license SAP DB. The open source database was then rebranded MaxDB. It is optimized to run in conjunction with the mySAP Business Suite and the MySQL database management system.

Dig Deeper on SAP security

Start the conversation

Send me notifications when other members comment.

Please create a username to comment.