Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1385621-6)
SAP Support Packages
(SAP_ITS_620_999999_999999, SAP_ITS_620_SP035_000035, SAP_ITS_620_SP999999_999999)
Описание
The check of the service names for special characters is insufficient.
Как исправить
Apply patch 35 mentioned below. We plan to make this patch available to download from SAP Service Marketplace at the end of Q4/2009.
To correct this vulnerability on ITS servers that use patch level 34 or lower and while patch 35 is still not available to download, implement the following source code corrections in the file.
Windows:
\Program Files\SAP\ITS\6.20\<INSTANCE>\templates\system\dm\login.html
Linux:
/usr/sap/its/6.20/<INSTANCE>/templates/system/dm/login.html.
- After the line
include( ~service="system", ~theme="dm", ~language="", ~name="its_util.html");
add the following lines:
mywgateurl = wgateurl();
mywgateurl = strmask(mywgateurl);
Make sure that you do not delete the accent grave character `.
- In the code that follows, replace all of the calls
wgateURL()
with
mywgateurl.
Again, make sure that you do not delete the existing accent grave character `.
After these changes, you must use the ITS administration tool to invalidate the template cache or you must restart the relevant ITS instance.
To correct this vulnerability on ITS servers that use patch level 34 or lower and while patch 35 is still not available to download, implement the following source code corrections in the file.
Windows:
\Program Files\SAP\ITS\6.20\<INSTANCE>\templates\system\dm\login.html
Linux:
/usr/sap/its/6.20/<INSTANCE>/templates/system/dm/login.html.
- After the line
include( ~service="system", ~theme="dm", ~language="", ~name="its_util.html");
add the following lines:
mywgateurl = wgateurl();
mywgateurl = strmask(mywgateurl);
Make sure that you do not delete the accent grave character `.
- In the code that follows, replace all of the calls
wgateURL()
with
mywgateurl.
Again, make sure that you do not delete the existing accent grave character `.
After these changes, you must use the ITS administration tool to invalidate the template cache or you must restart the relevant ITS instance.
Ссылки
