CVE-2003-0943: High severity sap sap db vulnerability
web-tools in SAP DB before 7.4.03.30 installs several services that are enabled by default, which could allow remote attackers to obtain potentially sensitive information or redirect attacks against internal databases via (1) waecho, (2) Web SQL Interface (websql), or (3) Web Database Manager (webdbm).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SAP DB web-tools (SAP MaxDB)to a version that resolves this vulnerability.Fixed in 7.4.03.30 - Configuration
Stop and disable the waecho service installed by web-tools (set the service to disabled or equivalent) to prevent remote access.
waecho service (installed by web-tools) enabled = false - Configuration
Stop and disable the Web SQL Interface (websql) service installed by web-tools (set the service to disabled or equivalent) to prevent remote access.
Web SQL Interface (websql) service (installed by web-tools) enabled = false - Configuration
Stop and disable the Web Database Manager (webdbm) service installed by web-tools (set the service to disabled or equivalent) to prevent remote access.
Web Database Manager (webdbm) service (installed by web-tools) enabled = false
Event History
Frequently Asked Questions
What is the severity of CVE-2003-0943?
CVE-2003-0943 is classified as a medium severity vulnerability due to its potential to expose sensitive information.
How do I fix CVE-2003-0943?
To fix CVE-2003-0943, users should upgrade SAP DB to version 7.4.03.30 or later, which disables default services.
What services are affected by CVE-2003-0943?
CVE-2003-0943 affects the waecho, Web SQL Interface (websql), and Web Database Manager (webdb) services.
Who is at risk from CVE-2003-0943?
Organizations using SAP DB versions prior to 7.4.03.30 are at risk of CVE-2003-0943.
Can CVE-2003-0943 be exploited remotely?
Yes, CVE-2003-0943 can be exploited remotely, allowing attackers to access internal databases.