CVE-2012-2612 Denial of service in n/a
Remote attackers can crash the SAP NetWeaver Dispatcher daemon by sending a crafted SAP Diag packet, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2012-2612?
CVE-2012-2612 is a medium-severity denial of service vulnerability in Sap Netweaver, published on 15 May 2012. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The DiagTraceHex function in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2 allows remote attackers to cause a denial of service (daemon crash) via a crafted SAP Diag packet.
Weakness: CWE-119
Which versions are affected by CVE-2012-2612?
It affects 1 product.
Products include Sap Netweaver.
How do I fix CVE-2012-2612?
No fix has been published for CVE-2012-2612 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2012-2612 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2012-2612 exists.
Public exploit code: 2 Exploit-DB entries.
Other vulnerabilities in Sap Netweaver
Sources
Also known as GHSA-jvvg-vxw3-4c2h.