Vulnerability Details : CVE-2015-7986
The index server (hdbindexserver) in SAP HANA 1.00.095 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via an HTTP request, aka SAP Security Note 2197428.
Vulnerability category: OverflowMemory CorruptionExecute codeDenial of service
Exploit prediction scoring system (EPSS) score for CVE-2015-7986
Probability of exploitation activity in the next 30 days: 30.44%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 96 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2015-7986
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST |
CWE ids for CVE-2015-7986
-
The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-7986
-
https://www.exploit-db.com/exploits/39382/
SAP HANA 1.00.095 - hdbindexserver Memory Corruption
-
http://seclists.org/fulldisclosure/2016/Jan/94
Full Disclosure: [ERPSCAN-15-024] SAP HANA hdbindexserver - Memory corruption
-
http://scn.sap.com/community/security/blog/2015/10/14/sap-security-notes-october-2015--review
Page not found | SAP BlogsVendor Advisory
-
http://www.securityfocus.com/archive/1/537376/100/0/threaded
SecurityFocus
-
https://erpscan.io/advisories/erpscan-15-024-sap-hana-hdbindexserver-memory-corruption/
[ERPSCAN-15-024] SAP HANA hdbindexserver - Memory corruption
-
http://packetstormsecurity.com/files/135416/SAP-HANA-hdbindexserver-Memory-Corruption.html
SAP HANA hdbindexserver Memory Corruption ≈ Packet StormExploit
Products affected by CVE-2015-7986
- cpe:2.3:a:sap:hana:*:*:*:*:*:*:*:*