CVE-2007-1914: High severity SAP RFC Library vulnerability

Published Apr 10, 2007

Updated

The RFCSTARTPROGRAM function in the SAP RFC Library 6.40 and 7.00 before 20061211 allows remote attackers to obtain sensitive information (external RFC server configuration data) via unspecified vectors, a different vulnerability than CVE-2006-6010. NOTE: This information is based upon a vague initial disclosure. Details will be updated after the grace period has ended.

Affected Software

2 affected components

SAP RFC Library=6.4

SAP RFC Library=7.0

Remediation

Patch Available

http://www.cybsec.com/vuln/CYBSEC-Security_Advisory_SAP_RFC_START_PROGRAM_RFC_Function_Multiple_Vulnerabilities.pdf

Event History

Apr 10, 2007

CVE Published

11:19 PM

Apr 11, 2007

CVE Published

via MITRE·03:00 AM

Data Sourced

via MITRE·03:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-1914?

CVE-2007-1914 is categorized with a medium severity due to the potential exposure of sensitive RFC server configuration data.

How do I fix CVE-2007-1914?

To mitigate CVE-2007-1914, update the SAP RFC Library to versions 6.40 or 7.00 after the 20061211 patch.

Who is affected by CVE-2007-1914?

The vulnerability primarily affects users of SAP RFC Library versions 6.40 and 7.00 before the specified patch release.

What type of attack does CVE-2007-1914 allow?

CVE-2007-1914 allows remote attackers to obtain sensitive configuration data from the RFC server.

Is CVE-2007-1914 a new vulnerability?

CVE-2007-1914 is not a new vulnerability; it is distinct from CVE-2006-6010 but leverages similar attack vectors.