CVE-2018-2439: Code Injection
The SAP Internet Graphics Server (IGS), 7.20, 7.20EXT, 7.45, 7.49, 7.53, has insufficient request validation (for example, where the request is validated for authenticity and validity) and under certain conditions, will process invalid requests. Several areas of the SAP Internet Graphics Server (IGS) did not require sufficient input validation. Namely, the SAP Internet Graphics Server (IGS) HTTP and RFC listener, SAP Internet Graphics Server (IGS) portwatcher when registering a portwatcher to the multiplexer and the SAP Internet Graphics Server (IGS) multiplexer had insufficient input validation and thus allowing a malformed data packet to cause a crash.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2018-2439?
CVE-2018-2439 is a vulnerability that affects the SAP Internet Graphics Server (IGS) versions 7.20, 7.20EXT, 7.45, 7.49, and 7.53. It allows processing of invalid requests under certain conditions due to insufficient request validation.
How severe is CVE-2018-2439?
CVE-2018-2439 has a severity rating of medium with a score of 5.9.
What is the affected software?
The affected software is the SAP Internet Graphics Server (IGS) versions 7.20, 7.20EXT, 7.45, 7.49, and 7.53.
How can I fix CVE-2018-2439?
To fix CVE-2018-2439, it is recommended to apply the necessary patches provided by SAP and ensure that the SAP Internet Graphics Server (IGS) is updated to a secure version.
Where can I find more information about CVE-2018-2439?
More information about CVE-2018-2439 can be found at the following references: [1] http://www.securityfocus.com/bid/104708 [2] https://launchpad.support.sap.com/#/notes/2644147 [3] https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=497256000