Menu
Use SAP's mobile platform? Patch now to avoid these 'high risk' vulnerabilities

Use SAP's mobile platform? Patch now to avoid these 'high risk' vulnerabilities

The flaws could give attackers access to encrypted information

Mobile security

Mobile security

Three high risk vulnerabilities in SAP Mobile could give attackers access to encrypted information stored in mobile devices, security firm Onapsis reported Wednesday.

All three vulnerabilities were recently fixed by SAP, but systems are only safe if the patches are applied.

"SAP runs so many of the world's largest enterprises that any vulnerability must be taken very seriously," said Nicholas Taylor, CEO of Netlogx, another security provider.

One of the flaws enables keystream recovery and could allow an attacker with access to a vulnerable device to decrypt credentials and other sensitive information stored within, Onapsis said. The attacker could then potentially connect to other business systems to access additional data.

Because of predictable encryption passwords for configuration values, meanwhile, another flaw makes it possible for attackers to decrypt and modify sensitive configuration values used by SAP business applications. That, in turn, could expose a broad set of software to an attack.

The third vulnerability exploits predictable encryption storage passwords, giving attackers the ability to read sensitive information stored in the vulnerable device, including log-in credentials. With that information, an attacker could potentially connect to business applications and access or modify business information.

Companies use SAP's mobile platform to create and deploy apps for their employees, partners and customers. Depending on how an organization uses the technology, the flaws could offer access to mission-critical information including customer data, product pricing, financial statements, employee information, supply chains, business intelligence, budgeting, planning and forecasting, Onapsis said.

We provide recommendations on the secure setup and operation of SAP systems, and we regularly issue critical security patches," SAP said in response to the report. "Although we strongly urge customers to implement those patches and recommendations in a timely manner, we often do not have control over when this is done."

SAP users are advised to implement security patches as they are issued, it said.


Follow Us

Join the newsletter!

Error: Please check your email address.

Tags applicationssecuritySalesforce.comenterprise resource planningmobile securitySAPsoftwareExploits / vulnerabilities

Featured

Slideshows

Tech industry comes together as Lexel celebrates turning 30

Tech industry comes together as Lexel celebrates turning 30

Leading figures within the technology industry across New Zealand came together to celebrate 30 years of success for Lexel Systems, at a milestone birthday occasion at St Matthews in the City.​

Tech industry comes together as Lexel celebrates turning 30
HP re-imagines education through Auckland event launch

HP re-imagines education through Auckland event launch

HP New Zealand held an inaugural Evolve Education event at Aotea Centre in Auckland, welcoming over 70 principals, teachers and education experts to explore ways of shaping and enhancing learning using technology.

HP re-imagines education through Auckland event launch
Reseller News ICT Industry Awards 2017 - Meet the winners...

Reseller News ICT Industry Awards 2017 - Meet the winners...

Reseller News honoured the industry’s finest on a standout evening for the New Zealand channel, recognising the achievements of established and emerging partners on a memorable night in Auckland.

Reseller News ICT Industry Awards 2017 - Meet the winners...
Show Comments