Menu
Nvidia takes customer site offline after SAP bug found

Nvidia takes customer site offline after SAP bug found

The three-year-old flaw in NetWeaver could have allowed access to other critical business software

Graphics chipmaker Nvidia took a customer service website offline Wednesday following a public report of a vulnerability in its SAP-powered backend.

The affected website, https://nvcare.nvidia.com, uses SAP's NetWeaver, which is a framework that underpins many SAP business applications. The NetWeaver vulnerability is close to three years old and has been patched by SAP, but it appears Nvidia didn't apply the fix.

The finder of the vulnerability is simply listed as a person going by the nickname "Finger," based in China. According to the bug report, Finger notified Nvidia on Nov. 21. The status of the bug is listed as "unable to contact the vendor or actively neglected by the vendor" and notes that it was publicly released on Jan. 5.

Nvidia said in a statement it learned of the issue on Wednesday and shut the site down until it is fixed.

"At this point, we have no evidence that customer data was compromised," wrote Bob Sherbin of Nvidia's corporate communications, in an email. "We are continuing to investigate the matter.

The report was posted on a Chinese vulnerability forum, WooYun.org, and reposted on Full Disclosure, a widely read vulnerability forum.

The vulnerability would allow an unauthenticated hacker to remotely take full control of the SAP NetWeaver portal platform, said Mariano Nunez, CEO of Onapsis, a Boston-based company that specializes in SAP security.

"This includes the ability to create an attacker-controlled administrator user, execute operating systems commands and take the entire system offline," he said via email. "Many SAP NetWeaver Portal systems are directly connected to the Internet. This means anyone from a foreign country can remotely exploit this issue."

Once NetWeaver is compromised, an attacker could then get access to ERP, CRM, supply chain or business intelligence systems, Nunez said.

SAP has undertaken a campaign to improve the security of its products over the past few years. But security researchers note that many of its customers fail to maintain the software, which exposes them to attacks that could compromise confidential information.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags OnapsissecuritynvidiaExploits / vulnerabilities

Featured

Slideshows

Reseller News launches inaugural Hall of Fame lunch

Reseller News launches inaugural Hall of Fame lunch

Reseller News welcomed 2015 and 2016 inductees - Darryl Swann, Dave Rosenberg, Gary Bigwood, Keith Watson, Mike Hill and Scott Green - to the inaugural Reseller News Hall of Fame lunch, held at the French Cafe in Auckland. The inductees discussed how the channel can collectively work together to benefit New Zealand, the Kiwi skills shortage and the future of the industry. Photos by Maria Stefina.

Reseller News launches inaugural Hall of Fame lunch
Educating from the epicentre - Why distributors are the pulse checkers of the channel

Educating from the epicentre - Why distributors are the pulse checkers of the channel

​As the channel changes and industry voices deepen, the need for clarity and insight heightens. Market misconceptions talk of an “under pressure” distribution space, with competitors in that fateful “race for relevance” across New Zealand. Amidst the cliched assumptions however, distribution is once again showing its strength, as a force to be listened to, rather than questioned. Traditionally, the role was born out of a need for vendors and resellers to find one another, acting as a bridge between the testing lab and the marketplace. Yet despite new technologies and business approaches shaking the channel to its very core, distributors remain tied to the epicentre - providing the voice of reason amidst a seismic industry shift. In looking across both sides of the vendor and partner fences, the middle concept of the three-tier chain remains centrally placed to understand the metrics of two differing worlds, as the continual pulse checkers of the local channel. This exclusive Reseller News Roundtable, in association with Dicker Data and rhipe, examined the pivotal role of distribution in understanding the health of the channel, educating from the epicentre as the market transforms at a rapid rate.

Educating from the epicentre - Why distributors are the pulse checkers of the channel
Kiwi channel reunites as After Hours kicks off 2017

Kiwi channel reunites as After Hours kicks off 2017

After Hours made a welcome return to the channel social calendar last night, with a bumper crowd of distributors, vendors and resellers descending on The Jefferson in Auckland to kickstart 2017. Photos by Maria Stefina.

Kiwi channel reunites as After Hours kicks off 2017
Show Comments