SAP Netweaver DiagTraceR3Info Remote Buffer Overflow Exploit

The DiagTraceR3Info function of the disp+work.exe component of SAP Netweaver is prone to a remote buffer overflow when the worker process trace level is set to values 2 or 3 for the Dialog Processor component. This vulnerability can be exploited to execute arbitrary code on the vulnerable machine by sending a specially crafted packet containing ST_R3INFO CODEPAGE items. This exploit bypasses Data Execution Prevention (DEP). Agents installed with this module will run under the SAPServiceSNP user account.