The Abap Underverse - Risky Abap To Kernel Communication And Abap-Tunneled Buffer Overflows presented at Blackhat Europe 2011

by Andreas Wiegenstein (Virtual Forge GmbH),

Tags: Security

Summary : While ABAP is an advanced, high level business programming language, it provides several low-level interfaces called kernel calls. These kernel calls allow for data exchange between ABAP and the C-Based SAP kernel. SAP's documentation strongly encourages developers not to use kernel calls. This presentation shows what can happen if kernel calls are used and gives a brief overview over some of the most dangerous kernel calls, largely unknown even to seasoned ABAP developers.

The first part of the presentation will introduce several dangerous kernel calls and show how their usage can bypass security features in the SAP standard.

The second part of the presentation will focus on buffer overflow risks related to kernel calls.

While buffer overflows are nothing new, you will see vulnerabilities where ABAP is used as a tunneling agent to propagate buffer overflow attacks to the inner SAP kernel.