SAP HANA CVE-2016-6145/6144 Info Disclosure and Brute Force Vulnerability Analysis

Below are the key details about the vulnerability from the web screenshot: Vulnerability Overview Onapsis released 15 advisories related to SAP HANA and build components - Date: July 21, 2016 Main Vulnerability Details 1. Information Disclosure via Error Messages - CVE ID: CVE-2016-6145 - Description: When logging into the SAP HANA database via the SQL interface, error messages reveal excessive information, allowing attackers to identify different database users. 2. SAP HANA SYSTEM User Brute Force Attack - CVE ID: CVE-2016-6144 - Description: Attackers can perform brute force attacks to gain access to the most powerful user on the SAP HANA platform: SYSTEM. Technical Details Error Message Examples: - Example message: "DatabaseError: invalid username or password" - When a user exists but is locked, the error message is different. Vulnerability Impact: - Attackers can identify valid users by analyzing different error messages. - Attackers can exploit this vulnerability to determine the number of failed login attempts for locked users, enabling brute force attacks without triggering account lockout. Remediation Recommendations SAP Security Note 2216869 - Introduced the parameter to control the amount of information displayed in login error messages. - Setting this parameter to will standardize error messages to "Authentication failed". Security Measures for SYSTEM User: - Introduced the parameter to lock the SYSTEM user after a specified threshold of invalid login attempts. Conclusion It is critical to maintain the latest security patches for the SAP HANA platform and configure it according to SAP HANA security guidelines.

Goal Reached Thanks to every supporter — we hit 100%!

SAP HANA CVE-2016-6145/6144 Info Disclosure and Brute Force Vulnerability Analysis