topic Re: SAP, OpenSSL, and Heartbleed in Application Development and Automation Discussions

SAP, OpenSSL, and Heartbleed

Matt_Fraser — Wed, 09 Apr 2014 21:35:39 GMT

I'm sure by now everyone has heard more than they wanted to about the latest vulnerability sweeping the Internet. As far as I can tell, SAP NetWeaver systems don't have any built-in OpenSSL components and shouldn't be vulnerable, but I'm not 100% sure about this. I'm a little surprised that I can't find any mention of Heartbleed in any of the forums today.

So, can anyone state with authority that I'm correct about this, and NetWeaver (ABAP and/or Java) systems are not inherently vulnerable to this flaw?

Thanks,

Matt

Re: SAP, OpenSSL, and Heartbleed

Former Member — Wed, 09 Apr 2014 21:45:53 GMT

By default SAP uses SAP Cryptographic Library (or CommonCryptoLib in most recent releases) for SSL so the question becomes does SAP's library share code with the vulnerable TLS implementation in OpenSSL.

Re: SAP, OpenSSL, and Heartbleed

Matt_Fraser — Wed, 09 Apr 2014 21:48:46 GMT

Yes, thank you, that's a better way of restating my question.

Re: SAP, OpenSSL, and Heartbleed

Former Member — Wed, 09 Apr 2014 22:02:44 GMT

I have only ever seen customers with internet facing scenarios use openSSL for internal POC (proof of concept) purposes. For real scenarios they have their own CA.

The others are self-signed or http even, if it is just browsing a catalogue without actually ordering anything.

I am not aware that SAP have any special discrimination against openSSL. Why should SAP do that, other than making recommendations which CA to use... (can't see that happening either, other than their own Trust Center..).

Cheers,

Julius

Re: SAP, OpenSSL, and Heartbleed

Matt_Fraser — Wed, 09 Apr 2014 22:08:50 GMT

So there isn't any code reuse from OpenSSL within sapcryptolib or common-cryptolib, then? I wasn't thinking so much of the CA scenario, though I understand what you mean by that, but whether as an SSL-protected host there would be any vulnerabilities related to this.

Re: SAP, OpenSSL, and Heartbleed

Former Member — Wed, 09 Apr 2014 22:22:32 GMT

None that I am aware of. It is just an option.

Probably SAP will make some recommendations (I remember some when TSL got into trouble in 2011, partly caused by a "SAP engineer"), but I can't see them blocking openSSL or changing backward compatibility to cipher suites.

My 2 cents (not authoritative, but I did ping the grand master of encryption in SAP about this thread),

Julius

Re: SAP, OpenSSL, and Heartbleed

Matt_Fraser — Wed, 09 Apr 2014 22:29:39 GMT

Awesome, thanks for doing that.

Re: SAP, OpenSSL, and Heartbleed

mvoros — Wed, 09 Apr 2014 22:53:50 GMT

Hi Julius,

I think you are confused here what OpenSSL is. This issue has nothing directly related to CAs except that if you decide to re-issue your certs then you need to contact your CA.

OpenSSL is a library that implements SSL and TLS protocols. There was a bug in one extension called Heartbeat. Hence the name of bug is heartbleed. The bug allowed a malicious attacker to read 64kB of memory per connection. The bug is already fixed in version 1.0.1g. The problem with this issue is that just patching might not be enough.If somebody new about this issue before they could retrieve private keys for any systems that used vulnerable OpenSSL. Hence the safest resolution is to patch all systems that use OpenSSL and then re-issue all certificates. The decision if re-issuing of all certs is necessary is up to every customer.

Regarding original question. I am just speculating here. I doubt that SAP SSL implementation is using code from OpenSSL. Here is a quote from OpenSSL license.

* 2. Redistributions in binary form must reproduce the above copyright

* notice, this list of conditions and the following disclaimer in

* the documentation and/or other materials provided with the

* distribution.

I've never seen this with SAP SSL library. So unless SAP is breaking OpenSSL license we are safe. Another reason why I think we are safe is that this was quite a new extension. SAP is usually slow with rolling out new crypto (which is good). So I doubt that SAP SSL implementation supports this extension. Hence I think that ABAP AS and Java AS are safe but there might be other SAP products that use OpenSSL.

Cheers

Re: SAP, OpenSSL, and Heartbleed

mvoros — Wed, 09 Apr 2014 22:55:21 GMT

SAP employee discovered that bug. I would not call that "causing the issue" 🙂

Cheers

Re: SAP, OpenSSL, and Heartbleed

Matt_Fraser — Wed, 09 Apr 2014 23:04:10 GMT

Thanks, Martin. Yes, this was precisely my question. I have seen some mention of OpenSSL being credited as one of many third-party products used in ADS, though it wasn't clear in what fashion (since ADS would simply reuse the NetWeaver Java AS' security protocols, no?), so that did make me wonder. I've also seen elsewhere that the Java AS includes a cryptography suite from IAIK. So, that made me wonder whether if SAP did reuse some third-party code in sapcryptolib, would the copyright notice for same be buried in the code itself?

At the moment I'm feeling reasonably secure about this (as secure as one ever feels in the face of the unknown, anyway), as if this truly were a problem I'd have expected there to be a lot more chatter here about it, and/or there would have been an identified patch to common-cryptolib or sapcryptolib within the past day or so, which doesn't seem to have been the case. Perhaps that patch will come out in the next couple days, but I'm thinking you're right, and OpenSSL's mistake isn't repeated here.

Regards,

Matt

Re: SAP, OpenSSL, and Heartbleed

Former Member — Wed, 09 Apr 2014 23:06:10 GMT

The resultant trouble was caused by something discovered by a SAP engineer, not the problem itself caused by SAP. That is what I meant.

Cheers,

Julius

Re: SAP, OpenSSL, and Heartbleed

mvoros — Wed, 09 Apr 2014 23:09:08 GMT

I would not rely on lack of chatter here. SAP world is special. Sadly, it's still common to think that SAP security == authorization. But it's getting better. People started asking questions about weak cipher suits. Actually, I guess that there might be some open source tool already published that allows you to test your servers. I would try it against SAP systems and see how it goes.

BTW what is ADS?

Cheers

Re: SAP, OpenSSL, and Heartbleed

mvoros — Wed, 09 Apr 2014 23:13:00 GMT

Just an update. I found this Test your server for Heartbleed (CVE-2014-0160) . I did execute it against external facing portal that has SAP web dispatcher in front of it. It says that the system is not affected by this issue. My guess is that this extension is not supported by SAP.

Cheers

Re: SAP, OpenSSL, and Heartbleed

Former Member — Wed, 09 Apr 2014 23:34:55 GMT

I think Matt meant Adobe Document Services.

Re: SAP, OpenSSL, and Heartbleed

Former Member — Wed, 09 Apr 2014 23:38:07 GMT

I am not aware that SAP has any imbedding of openSSL for ADS. Actually I can hardly imagine that because it is an internal server.

I have only ever encountered openSSL for (internal) POCs.

Lets wait for the guru (I pinged him).

Cheers,

Julius

Re: SAP, OpenSSL, and Heartbleed

mvoros — Wed, 09 Apr 2014 23:58:40 GMT

Based on this note 1633459 ADS uses OpenSSL. It still might not be vulnerable. I don't think it uses OpenSSL for TLS. I think it uses it as a crypto library for signing PDFs. But again, pure speculation. So I think it's SAP's turn.

Cheers

Re: SAP, OpenSSL, and Heartbleed

Former Member — Thu, 10 Apr 2014 13:03:13 GMT

Hello,

"I've never seen this with SAP SSL library. So unless SAP is breaking OpenSSL license we are safe"

Well, SAP may not use OpenSSL but it does not mean that OpenSSL is not used by a SAP connection.

In my company, I have an SRM system which is published on the internet with this architecture :

Apache Reverse proxy in DMZ1 --> SAP Web Dispatcher in DMZ2 --> SRM in company internal network.

The Apache reverse proxy does use OpenSSL. I tested the access with http://filippo.io/Heartbleed and I don't have the vulnerability.

The irony is this is because our OpenSSL is too old to have the bug !

Regards,

Olivier

Re: SAP, OpenSSL, and Heartbleed

allaine_tabilin — Thu, 10 Apr 2014 13:31:25 GMT

SAP released a statement on the BO

2003582 - How does The Heartbleed Bug (OpenSSL vulnerability) affects SAP BusinessObjects Xi3.1 and Business Intelligence products 4/4.1

... Basically stating that the product is not impacted ...

SAP BusinessObjects Enterprise is not subject to the heartbleed vulnerability. In this release, an unaffected version of OpenSSL (version 0.9.8) is leveraged for steamworks integration only.
The regular BI Platform services use a RSA implementation of SSL for secure communication, which is also not affected.

Regards,

Allaine

Re: SAP, OpenSSL, and Heartbleed

Matt_Fraser — Thu, 10 Apr 2014 15:26:57 GMT

Yes, that's right, I meant Adobe Document Services.

Re: SAP, OpenSSL, and Heartbleed

Matt_Fraser — Thu, 10 Apr 2014 15:29:46 GMT

An even more comprehensive test, for all sorts of SSL configuration issues, not just Heartbleed vulnerability, is at Qualys SSL Labs - Projects / SSL Server Test. However, neither one of these is easy (or possible, rather) to use for an internal-only system. The mechanism used by filippio.io might be adaptable for internal use, but I'm not sure how to do that.