SAP Business Client, versions 6.5, 7.0, does not perform necessary integrity checks which could be exploited by an attacker under certain conditions to modify the installer.
Weakness
The product does not validate or incorrectly validates the integrity check values or “checksums” of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Business_client | Sap | 6.0 (including) | 6.0 (including) |
| Business_client | Sap | 6.0-patch_level1 (including) | 6.0-patch_level1 (including) |
| Business_client | Sap | 6.0-patch_level10 (including) | 6.0-patch_level10 (including) |
| Business_client | Sap | 6.0-patch_level11 (including) | 6.0-patch_level11 (including) |
| Business_client | Sap | 6.0-patch_level12 (including) | 6.0-patch_level12 (including) |
| Business_client | Sap | 6.0-patch_level13 (including) | 6.0-patch_level13 (including) |
| Business_client | Sap | 6.0-patch_level14 (including) | 6.0-patch_level14 (including) |
| Business_client | Sap | 6.0-patch_level15 (including) | 6.0-patch_level15 (including) |
| Business_client | Sap | 6.0-patch_level16 (including) | 6.0-patch_level16 (including) |
| Business_client | Sap | 6.0-patch_level17 (including) | 6.0-patch_level17 (including) |
| Business_client | Sap | 6.0-patch_level2 (including) | 6.0-patch_level2 (including) |
| Business_client | Sap | 6.0-patch_level3 (including) | 6.0-patch_level3 (including) |
| Business_client | Sap | 6.0-patch_level4 (including) | 6.0-patch_level4 (including) |
| Business_client | Sap | 6.0-patch_level5 (including) | 6.0-patch_level5 (including) |
| Business_client | Sap | 6.0-patch_level6 (including) | 6.0-patch_level6 (including) |
| Business_client | Sap | 6.0-patch_level7 (including) | 6.0-patch_level7 (including) |
| Business_client | Sap | 6.0-patch_level8 (including) | 6.0-patch_level8 (including) |
| Business_client | Sap | 6.0-patch_level9 (including) | 6.0-patch_level9 (including) |
| Business_client | Sap | 6.5 (including) | 6.5 (including) |
| Business_client | Sap | 6.5-patch_level1 (including) | 6.5-patch_level1 (including) |
| Business_client | Sap | 6.5-patch_level10 (including) | 6.5-patch_level10 (including) |
| Business_client | Sap | 6.5-patch_level11 (including) | 6.5-patch_level11 (including) |
| Business_client | Sap | 6.5-patch_level12 (including) | 6.5-patch_level12 (including) |
| Business_client | Sap | 6.5-patch_level13 (including) | 6.5-patch_level13 (including) |
| Business_client | Sap | 6.5-patch_level14 (including) | 6.5-patch_level14 (including) |
| Business_client | Sap | 6.5-patch_level15 (including) | 6.5-patch_level15 (including) |
| Business_client | Sap | 6.5-patch_level16 (including) | 6.5-patch_level16 (including) |
| Business_client | Sap | 6.5-patch_level17 (including) | 6.5-patch_level17 (including) |
| Business_client | Sap | 6.5-patch_level18 (including) | 6.5-patch_level18 (including) |
| Business_client | Sap | 6.5-patch_level19 (including) | 6.5-patch_level19 (including) |
| Business_client | Sap | 6.5-patch_level2 (including) | 6.5-patch_level2 (including) |
| Business_client | Sap | 6.5-patch_level3 (including) | 6.5-patch_level3 (including) |
| Business_client | Sap | 6.5-patch_level4 (including) | 6.5-patch_level4 (including) |
| Business_client | Sap | 6.5-patch_level5 (including) | 6.5-patch_level5 (including) |
| Business_client | Sap | 6.5-patch_level6 (including) | 6.5-patch_level6 (including) |
| Business_client | Sap | 6.5-patch_level7 (including) | 6.5-patch_level7 (including) |
| Business_client | Sap | 6.5-patch_level8 (including) | 6.5-patch_level8 (including) |
| Business_client | Sap | 6.5-patch_level9 (including) | 6.5-patch_level9 (including) |
| Business_client | Sap | 7.0 (including) | 7.0 (including) |
| Business_client | Sap | 7.0-patch_level1 (including) | 7.0-patch_level1 (including) |
| Business_client | Sap | 7.0-patch_level2 (including) | 7.0-patch_level2 (including) |
| Business_client | Sap | 7.0-patch_level3 (including) | 7.0-patch_level3 (including) |
| Business_client | Sap | 7.0-patch_level4 (including) | 7.0-patch_level4 (including) |
| Business_client | Sap | 7.0-patch_level5 (including) | 7.0-patch_level5 (including) |
| Business_client | Sap | 7.0-patch_level6 (including) | 7.0-patch_level6 (including) |
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/145.html
- https://cwe.mitre.org/data/definitions/463.html
- https://cwe.mitre.org/data/definitions/75.html