Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Vulnerabilities » CVE-2006-0732


Vulnerability Score 6.4 6.4
CVE Id CVE-2006-0732
Last Modified 07 Mar 2011 09:30:43
Published 16 Feb 2006 06:02:00
Confidentiality Impact PARTIAL PARTIAL
Integrity Impact PARTIAL PARTIAL
Availability Impact NONE NONE
Access Vector NETWORK
Access Complexity LOW
Authentication NONE



Directory traversal vulnerability in SAP Business Connector (BC) 4.6 and 4.7 allows remote attackers to read or delete arbitrary files via the fullName parameter to (1) sapbc/SAP/chopSAPLog.dsp or (2) invoke/sap.monitor.rfcTrace/deleteSingle. Details will be updated after the grace period has ended. NOTE: SAP Business Connector is an OEM version of webMethods Integration Server. webMethods states that this issue can only occur when the product is installed as root/admin, and if the attacker has access to a general purpose port; however, both are discouraged in the documentation. In addition, the attacker must already have acquired administrative privileges through other means.

Vulnerable Systems


  • Sap Business Connector 4.6

  • Sap Business Connector 4.7


VUPEN - ADV-2006-0611

BID - 16668

BUGTRAQ - 20060215 CYBSEC - Security Pre-Advisory: Arbitrary File Read/Delete in SAPBC



SECTRACK - 1016122

SECTRACK - 1015639

SECUNIA - 18880

BUGTRAQ - 20060515 CYBSEC - Security Advisory: Arbitrary File Read/Delete in SAP BC(Business Connector)

SECTRACK - 1016090

Last Updated: 27 May 2016 10:41:46