CVE-2014-0984
SAP Router - Timing Side-Channel Attack via Password Validation
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2014-0984. PoCs published by Core Security.
AI-analyzed exploit summary The provided code is a detailed advisory and partial proof-of-concept for CVE-2014-0984, a timing attack vulnerability in SAP Router's password check function. It includes assembly-level analysis of the vulnerable function and a Python script snippet for measuring response times.
Description
The passwordCheck function in SAP Router 721 patch 117, 720 patch 411, 710 patch 029, and earlier terminates validation of a Route Permission Table entry password upon encountering the first incorrect character, which allows remote attackers to obtain passwords via a brute-force attack that relies on timing differences in responses to incorrect password guesses, aka a timing side-channel attack.
Exploits (1)
The provided code is a detailed advisory and partial proof-of-concept for CVE-2014-0984, a timing attack vulnerability in SAP Router's password check function. It includes assembly-level analysis of the vulnerable function and a Python script snippet for measuring response times.