Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1371602-7)
SAP Support Packages
(SAPK-47222INMSG, SAPK-60017INMSG, SAPK-65011INMSG, SAPK-66005INMSG)
Описание
The problem is caused by an SQL injection vulnerability. In the source code, an SQL statement is comprised of strings, whereby a malicious user can gain control over the contents of a substring. By this means, the resulting total statement can be manipulated in order to modify data in the database or to make the database output additional data.
The program code contains a hard-coded username. If a user successfully logs on to the system using this username, this may result in the undesired disclosure of additional information.
FS-RI contains an error during the checking of paths to which data transferred by a user can be written. As a result, a malicious user can write arbitrary data to a remote system or overwrite data that may exist.
The program contains statements that enable a user to run their own code, which can change the system behavior. To do this, a user must (not) be logged on to the system with a valid access (At this point, describe all additional access prerequisites, if these exist).
Depending on the source code that the user injects, the user can retrieve additional information to which they should not actually have access. Additionally, the user can also modify or delete data, manipulate the output of the system, or create a new user with higher access rights. The availability of the system is also endangered.
The program code contains a hard-coded username. If a user successfully logs on to the system using this username, this may result in the undesired disclosure of additional information.
FS-RI contains an error during the checking of paths to which data transferred by a user can be written. As a result, a malicious user can write arbitrary data to a remote system or overwrite data that may exist.
The program contains statements that enable a user to run their own code, which can change the system behavior. To do this, a user must (not) be logged on to the system with a valid access (At this point, describe all additional access prerequisites, if these exist).
Depending on the source code that the user injects, the user can retrieve additional information to which they should not actually have access. Additionally, the user can also modify or delete data, manipulate the output of the system, or create a new user with higher access rights. The availability of the system is also endangered.
Как исправить
History:
Version 1 from 04-Aug-10: New
Version 2 from 01-Dec-10: Manual post-implementation steps changed
Version 3 from 01-Dec-10: Validity of the manual post-implementation steps changed
Implement the source code corrections.
Support Packages FSRI47262022, FSRI60070017, SAPK-65011INMSG and SAPK-66005INMSG correct the problem.
Solution:
The programs /MSG/R_ABR_KTOZUO_START, /MSG/R_FSRI_DATA_DOWNLOAD, /MSG/R_ISRI_DATA_DOWNLOAD, /MSG/R_LSMW_PROJ_CONV_472_600, and /MSG/R_A_B_AUFBAU_STAT_TABS are set to obsolete.
Technical effects:
The programs /MSG/R_ABR_KTOZUO_START, /MSG/R_FSRI_DATA_DOWNLOAD, Z_R_ISRI_DATA_DOWNLOAD, /MSG/R_LSMW_PROJ_CONV_472_600, and /MSG/R_A_B_AUFBAU_STAT_TABS can no longer be used.
After you implement this note, you must carry out the following manual tasks:
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component FS-RI Financial Servi...|
| Release 472 SAPK-47214INMSG - SAPK-47221INMSG |
| Release 600 SAPK-60009INMSG - SAPK-60016INMSG |
------------------------------------------------------------------------
Call transaction SE38.
Enter the following program: /MSG/R_ABR_KTOZUO_START
Select "Text elements".
Choose "Change" (F6).
Sym Text
002 Report /MSG/R_ABR_KTOZUO_START
003 Report /MSG/R_ABR_KTOZUO_START is obsolete.
Choose "Activate" (Ctrl+F3).
Call transaction SE38.
Enter the following program: /MSG/R_A_B_AUFBAU_STAT_TABS
Select "Text elements".
Choose "Change" (F6).
Sym Text
123 Report /MSG/R_A_B_AUFBAU_STAT_TABS
124 Report /MSG/R_A_B_AUFBAU_STAT_TABS is obsolete.
Choose "Activate" (Ctrl+F3).
Call transaction SE38.
Enter the following program: /MSG/R_ISRI_DATA_DOWNLOAD
Select "Text elements".
Choose "Change" (F6).
Sym Text
018 Report /MSG/R_ISRI_DATA_DOWNLOAD
019 Report /MSG/R_ISRI_DATA_DOWNLOAD is obsolete.
Choose "Activate" (Ctrl+F3).
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component FS-RI Financial Servi...|
| Release 650 Until SAPK-65010INMSG |
| Release 660 Until SAPK-66004INMSG |
------------------------------------------------------------------------
Call transaction SE38.
Enter the following program: /MSG/R_ABR_KTOZUO_START
Select "Text elements".
Choose "Change" (F6).
Sym Text
002 Report /MSG/R_ABR_KTOZUO_START
003 Report /MSG/R_ABR_KTOZUO_START is obsolete.
Choose "Activate" (Ctrl+F3).
Call transaction SE38.
Enter the following program: /MSG/R_A_B_AUFBAU_STAT_TABS
Select "Text elements".
Choose "Change" (F6).
Sym Text
123 Report /MSG/R_A_B_AUFBAU_STAT_TABS
124 Report /MSG/R_A_B_AUFBAU_STAT_TABS is obsolete.
Choose "Activate" (Ctrl+F3).
Call transaction SE38.
Enter the following program: /MSG/R_FSRI_DATA_DOWNLOAD
Select "Text elements".
Choose "Change" (F6).
Sym Text
018 Report /MSG/R_FSRI_DATA_DOWNLOAD
019 Report /MSG/R_FSRI_DATA_DOWNLOAD is obsolete.
Choose "Activate" (Ctrl+F3).
Call transaction SE38.
Enter the following program: /MSG/R_LSMW_PROJ_CONV_472_600
Select "Text elements".
Choose "Change" (F6).
Sym Text
005 Report /MSG/R_LSMW_PROJ_CONV_472_600
006 Report /MSG/R_LSMW_PROJ_CONV_472_600 is obsolete.
Choose "Activate" (Ctrl+F3).
Version 1 from 04-Aug-10: New
Version 2 from 01-Dec-10: Manual post-implementation steps changed
Version 3 from 01-Dec-10: Validity of the manual post-implementation steps changed
Implement the source code corrections.
Support Packages FSRI47262022, FSRI60070017, SAPK-65011INMSG and SAPK-66005INMSG correct the problem.
Solution:
The programs /MSG/R_ABR_KTOZUO_START, /MSG/R_FSRI_DATA_DOWNLOAD, /MSG/R_ISRI_DATA_DOWNLOAD, /MSG/R_LSMW_PROJ_CONV_472_600, and /MSG/R_A_B_AUFBAU_STAT_TABS are set to obsolete.
Technical effects:
The programs /MSG/R_ABR_KTOZUO_START, /MSG/R_FSRI_DATA_DOWNLOAD, Z_R_ISRI_DATA_DOWNLOAD, /MSG/R_LSMW_PROJ_CONV_472_600, and /MSG/R_A_B_AUFBAU_STAT_TABS can no longer be used.
After you implement this note, you must carry out the following manual tasks:
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component FS-RI Financial Servi...|
| Release 472 SAPK-47214INMSG - SAPK-47221INMSG |
| Release 600 SAPK-60009INMSG - SAPK-60016INMSG |
------------------------------------------------------------------------
Call transaction SE38.
Enter the following program: /MSG/R_ABR_KTOZUO_START
Select "Text elements".
Choose "Change" (F6).
Sym Text
002 Report /MSG/R_ABR_KTOZUO_START
003 Report /MSG/R_ABR_KTOZUO_START is obsolete.
Choose "Activate" (Ctrl+F3).
Call transaction SE38.
Enter the following program: /MSG/R_A_B_AUFBAU_STAT_TABS
Select "Text elements".
Choose "Change" (F6).
Sym Text
123 Report /MSG/R_A_B_AUFBAU_STAT_TABS
124 Report /MSG/R_A_B_AUFBAU_STAT_TABS is obsolete.
Choose "Activate" (Ctrl+F3).
Call transaction SE38.
Enter the following program: /MSG/R_ISRI_DATA_DOWNLOAD
Select "Text elements".
Choose "Change" (F6).
Sym Text
018 Report /MSG/R_ISRI_DATA_DOWNLOAD
019 Report /MSG/R_ISRI_DATA_DOWNLOAD is obsolete.
Choose "Activate" (Ctrl+F3).
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component FS-RI Financial Servi...|
| Release 650 Until SAPK-65010INMSG |
| Release 660 Until SAPK-66004INMSG |
------------------------------------------------------------------------
Call transaction SE38.
Enter the following program: /MSG/R_ABR_KTOZUO_START
Select "Text elements".
Choose "Change" (F6).
Sym Text
002 Report /MSG/R_ABR_KTOZUO_START
003 Report /MSG/R_ABR_KTOZUO_START is obsolete.
Choose "Activate" (Ctrl+F3).
Call transaction SE38.
Enter the following program: /MSG/R_A_B_AUFBAU_STAT_TABS
Select "Text elements".
Choose "Change" (F6).
Sym Text
123 Report /MSG/R_A_B_AUFBAU_STAT_TABS
124 Report /MSG/R_A_B_AUFBAU_STAT_TABS is obsolete.
Choose "Activate" (Ctrl+F3).
Call transaction SE38.
Enter the following program: /MSG/R_FSRI_DATA_DOWNLOAD
Select "Text elements".
Choose "Change" (F6).
Sym Text
018 Report /MSG/R_FSRI_DATA_DOWNLOAD
019 Report /MSG/R_FSRI_DATA_DOWNLOAD is obsolete.
Choose "Activate" (Ctrl+F3).
Call transaction SE38.
Enter the following program: /MSG/R_LSMW_PROJ_CONV_472_600
Select "Text elements".
Choose "Change" (F6).
Sym Text
005 Report /MSG/R_LSMW_PROJ_CONV_472_600
006 Report /MSG/R_LSMW_PROJ_CONV_472_600 is obsolete.
Choose "Activate" (Ctrl+F3).
Ссылки
