Description
The default installation of SAP R/3 46C/D allows remote attackers to bypass account locking by using the RFC API instead of the SAPGUI to conduct a brute force password guessing attack, which does not lock out the account like the SAPGUI does.
References
- 7007 vdb-entry
- 20030304 SAP R/3, account locking and RFC SDK mailing-list
- 20061112 Old SAP exploits mailing-list
- sap-sapinfo-lockout-bypass(11487) vdb-entry