CVE-2020-6295: 
SAP Adaptive Server Enterprise vulnerability analysis and mitigation

SAP Adaptive Server Enterprise (ASE) version 16.0 contains an information disclosure vulnerability (CVE-2020-6295) where sensitive information, including encrypted Cockpit passwords, can be exposed through publicly readable installation log files. The vulnerability was discovered and disclosed in 2020, affecting the installation process of SAP ASE and its Cockpit component (Trustwave Blog).

The vulnerability exists in the installation process where sensitive data is logged to the ASE_Suite.log file, which is publicly readable by any local user on Windows systems. The log file contains encrypted Cockpit repository passwords that can be decrypted using additional files (csibootstrap.properties and csikeystore.jceks) which are also publicly accessible. The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

If exploited, this vulnerability allows attackers to access encrypted sensitive and confidential information through the publicly readable installation log files. This access could lead to a compromise of the installed Cockpit, enabling attackers to view, modify, or make unavailable any data associated with the Cockpit (Trustwave Blog).

The vulnerability is exploitable by local users who can read the installation log file located at %SYBASE%\log\ASE_Suite.log. The attack requires access to additional files (csibootstrap.properties and csikeystore.jceks) to successfully decrypt the exposed passwords. A proof-of-concept exploit has been documented that demonstrates the password decryption process (Trustwave Blog).

SAP has released patches to address this vulnerability. Users should apply the security patches as detailed in SAP Security Note 2941332 (SAP Note).