The US Computer Emergency Readiness Team has warned of a vulnerability in SAP GUI, the graphical user interface client in SAP's enterprise resource planning software.
The unspecified flaw can cause Internet Explorer (IE) to crash in an exploitable manner. The flaw lies in an ActiveX control called MDrmSap, a component of SAP GUI.
The US Computer Emergency Readiness Team (US-CERT) warned in an advisory, updated on Monday, that, if a user were fooled into viewing a specially crafted HTML document, an external attacker might be able to gain control of their system, with their privileges.
A patch is available from SAP, through SAP Note 1142431. Login is required to access the patch.
Workarounds include disabling the MDrmSap ActiveX control in IE by setting the IE killbit for CLSID {B01952B0-AF66-11D1-B10D-0060086F6D97}, or IT professionals could disable IE ActiveX controls completely.
Security company Secunia warned in an advisory that the flaw was "highly critical". Versions of SAP GUI affected are 6.x and 7.x, according to Secunia.
