Description
Buffer overflow in SAPLPD 6.28 and earlier included in SAP GUI 7.10 and SAPSprint before 1018 allows remote attackers to execute arbitrary code via long arguments to the (1) 0x01, (2) 0x02, (3) 0x03, (4) 0x04, and (5) 0x05 LPD commands.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
SAP SAPLPD 6.28 Buffer Overflow
exploit/windows/lpd/saplpd
Exploit-DB 2
- SapLPD 6.28 - Remote Buffer Overflow (Metasploit) EDB-16338 · remote · May 9, 2010 · verified
- SapLPD 6.28 (Windows x86) - Remote Buffer Overflow EDB-5079 · remote · Feb 7, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 28786 third-party-advisory
- 20080205 Re: Multiple vulnerabilities in SAPlpd 6.28 mailing-list
- ADV-2008-0409 vdb-entry
- 1019300 vdb-entry
- 3619 third-party-advisory
- 20080204 Multiple vulnerabilities in SAPlpd 6.28 mailing-list
- ADV-2008-0438 vdb-entry
- 28811 third-party-advisory
- 27613 vdb-entry
- 5079 exploit