Luigi Auriemma has discovered some vulnerabilities in SAP GUI, which can be exploited by malicious people to cause a DoS (Denial of Service) or to potentially compromise a vulnerable system.

1) Multiple boundary errors exist in the SAPLPD server when processing LPD commands. This can be exploited to cause buffer overflows via overly long arguments passed to the LPD commands having the following codes: 0x01, 0x02, 0x03, 0x04, 0x05, 0x31, 0x32, 0x33, 0x34, and 0x35.

Successful exploitation may allow execution of arbitrary code.

2) An error in SAPLPD when processing the 0x53 LPD command code can be exploited to terminate an affected server.

The vulnerabilities are confirmed in SAPLPD version 6.28.0.1 included in SAP GUI versions 6.40 Patchlevel 29 and 7.10. Other versions may also be affected.

Solution
Update to the latest versions.
Further details available to Secunia VIM customers

Provided and/or discovered by
Luigi Auriemma

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://aluigi.altervista.org/adv/saplpdz-adv.txt

Deep Links
Links available to Secunia VIM customers