CVE-2014-0984: Medium severity SAP router vulnerability
The passwordCheck function in SAP Router 721 patch 117, 720 patch 411, 710 patch 029, and earlier terminates validation of a Route Permission Table entry password upon encountering the first incorrect character, which allows remote attackers to obtain passwords via a brute-force attack that relies on timing differences in responses to incorrect password guesses, aka a timing side-channel attack.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SAP Router 721to a version that resolves this vulnerability.Patch 117 - Upgrade
Upgrade
SAP Router 720to a version that resolves this vulnerability.Patch 411 - Upgrade
Upgrade
SAP Router 710to a version that resolves this vulnerability.Patch 029
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0984?
CVE-2014-0984 is considered a high severity vulnerability due to the ease with which attackers can exploit it using brute-force techniques.
How do I fix CVE-2014-0984?
To fix CVE-2014-0984, it is recommended to upgrade to the latest patched version of SAP Router that addresses this vulnerability.
What software versions are affected by CVE-2014-0984?
CVE-2014-0984 affects SAP Router versions 710-029, 720-411, and 721-117 and earlier.
What type of attack does CVE-2014-0984 enable?
CVE-2014-0984 enables remote attackers to conduct brute-force attacks on the password validation of route permissions.
Is CVE-2014-0984 still a concern in current environments?
Yes, CVE-2014-0984 remains a concern for environments using affected versions of SAP Router that have not been updated.