{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "SAP Internet Graphics Service (IGS) 7.x.",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    },
    {
      "description": "SAP Internet Graphics Service (IGS) 6.x ;",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "SAP",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nUne vuln\u00e9rabilit\u00e9 dans le traitement de certaines requ\u00eates HTTP permet \u00e0\nun utilisateur distant malintentionn\u00e9 de porter atteinte \u00e0 l\u0027int\u00e9grit\u00e9\ndes donn\u00e9es en supprimant arbitrairement des fichiers pr\u00e9sents sur le\nserveur.\n\nUne seconde vuln\u00e9rabilit\u00e9 permet \u00e0 un individu distant malveillant de\nporter atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es, de contourner la\npolitique de s\u00e9curit\u00e9 ou de r\u00e9aliser un d\u00e9ni de service en for\u00e7ant le\nsyst\u00e8me \u00e0 s\u0027arr\u00eater.\n\n## Solution\n\nAppliquer les correctifs de s\u00e9curit\u00e9 SAP cit\u00e9s dans les notes \\#959358\net \\#965201 (cf. section Documentation).\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [],
  "initial_release_date": "2006-12-06T00:00:00",
  "last_revision_date": "2006-12-06T00:00:00",
  "links": [
    {
      "title": "Note de mise \u00e0 jour de s\u00e9curit\u00e9 SAP #959358 :",
      "url": "http://service.sap.com/sap/support/notes/959358"
    },
    {
      "title": "Note de mise \u00e0 jour de s\u00e9curit\u00e9 SAP #965201 :",
      "url": "http://service.sap.com/sap/support/notes/965201"
    }
  ],
  "reference": "CERTA-2006-AVI-534",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2006-12-06T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Deux vuln\u00e9rabilit\u00e9s d\u00e9couvertes dans SAP Internet Graphics Service\npermettent \u00e0 un utilisateur distant malintentionn\u00e9 de r\u00e9aliser de\nnombreuses actions malveillantes sur le syst\u00e8me vuln\u00e9rable.\n",
  "title": "Vuln\u00e9rabilit\u00e9s dans SAP Internet Graphics Service",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletins de s\u00e9curit\u00e9 Cybsec du 12 d\u00e9cembre 2006",
      "url": "http://www.cybsec.com/vuln/CYBSEC-Security_Pre-Advisory_SAP_IGS_Undocumented_Features.pdf"
    }
  ]
}