Hackers have exploited SAP flaw for six years

The ability of businesses to patch legacy software has been thrust into the limelight, after the US government warned that hackers have been exploiting a flaw in SAP’s enterprise software – despite a patch being issued in 2010.

The Department of Homeland Security’s United States Computer Emergency Readiness Team, or US-CERT, has warned the vulnerability could give outside attackers remote control over older SAP systems if the patch has not been installed.

SAP left it up to system administrators to apply the patch to their systems when it issued the update.

US-CERT does not make a habit of issuing lots of security warnings. Indeed, it has only issued three such warnings this year. The last one advised Windows PC users to remove Apple Quicktime from their systems, after the iPad maker decided to quietly stop supporting it.

But the agency was spurred into action following a report from SAP security specialist Onapsis, which according to Reuters, said that dozens of companies have been exposed to these security gaps in recent years.

“This is not a new vulnerability,” Mariano Nunez, chief executive of Onapsis is quoted as saying. “Still, most SAP customers are unaware that this is going on.”

“At least 36 organisations worldwide are affected by a SAP vulnerability,” said the US-CERT warning. “Security researchers from Onapsis discovered indicators of exploitation against these organisations’ SAP business applications.”

“The observed indicators relate to the abuse of the Invoker Servlet, a built-in functionality in SAP NetWeaver Application Server Java systems (SAP Java platforms). The Invoker Servlet contains a vulnerability that was patched by SAP in 2010. However, the vulnerability continues to affect outdated and misconfigured SAP systems.”

SAP confirmed in a statement that it had patched the vulnerability back in 2010, and that all subsequent SAP applications are not affected by this flaw.

Patch delays

But SAP software tends to be used by businesses over many years, and a sizeable number of clients are said to be running older SAP software that can (in some cases) date back decades.

SAP software also tends to be internal facing, which means that it suffers less attacks than more outward facing systems such as websites, email or networks. But it seems that the major issue could be that businesses are not applying the patches that SAP issues, in a timely manner.

This point was made by Onapsis last year, when it revealed that more than 95 percent of companies running the SAP business application platform were vulnerable to security breaches because of unpatched software flaws.

US-CERT meanwhile recommends that users and administrators implement SAP Security Note 1445998 and disable the Invoker Servlet, to mitigate the vulnerability.