CVE-2017-8852: sap sapcar

Vulnerability summary

CVE-2017-8852 is a high (CVSS 7.8) vulnerability in sap sapcar. EPSS estimates a 3.30% chance of exploitation in the next 30 days, higher than 88.4% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 10-05-2017
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

SAP SAPCAR 721.510 has a Heap Based Buffer Overflow Vulnerability. It could be exploited with a crafted CAR archive file received from an untrusted remote source. The problem is that the length of data written is an arbitrary number found within the file. The vendor response is SAP Security Note 2441560.

• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.