Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1465917-5)
SAP Support Packages
(SAPK-70109INSAPBSFND, SAPK-70203INSAPBSFND)
Описание
A class method that was delivered with Enhancement Package 4 can be used to read any table via RFC using the table provider class.
Как исправить
The read capability of the table provider class is limited to Customizing tables that have to be specifically listed in a system table.
Implement the corrections from the correction instructions.
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BS_FND |
| Release 702 Until SAPK-70202INSAPBSFND |
------------------------------------------------------------------------
1. Create new messages.
a) Call transaction SE91.
b) Enter the message class /PLMB/BA_FRW.
c) Choose "Change".
d) Add message number 073:
"Tables (here: &1) with delivery class A cannot be read"
e) Add message number 074:
"Table &1 cannot be read"
f) Save the changes.
2. Create the table /PLMB/FRW_TABPRO.
a) Call transaction SE11.
b) Enter the table name /PLMB/FRW_TABPRO.
c) Choose 'Create'.
d) On the 'Delivery and Maintenance' tab page, choose the delivery class 'E' and choose 'Display/Maintenance Allowed' as the setting for 'Data Browser/Table View Maint.'.
e) Enter the field TABNAME with the data element TABNAME as a key field.
f) Choose 'Technical Settings' to maintain the technical settings of the table. Choose the following settings:
Data class = 'APPL2'
Size category = '0'
Buffering = 'Buffering switched on'
Buffering type = 'Fully Buffered'
g) Maintain the enhancement category by choosing 'Extras -> Enhancement Category...' and choose 'Cannot Be Enhanced'.
h) Save the change and assign the table to the package /PLMB/BA_FRW.
i) Activate the table.
j) Go to change mode.
k) On the 'Delivery and Maintenance' tab page, choose 'Maintain Customer Namespace' and for the key field TABNAME, set the entry 'Y*' and the entry 'Z*'.
l) Save the change.
3. Create a maintenance view.
a) Call transaction SE54.
b) Enter the table name /PLMB/FRW_TABPRO.
c) Choose 'Generated Objects'.
d) Choose 'Create/Change'.
e) Confirm the query.
f) Set the following parameters:
Authorization Group: &NC&
Function group: /PLMB/FRW_TABLES
Maintenance type One Step: X
Maint. Screen No. Overview screen: 101
g) Choose 'Create' (F6).
h) Save the changes.
4. Enter table names for the tables that can be accessed by the Table Provider.
a) Call transaction SM30.
b) Enter the table name /PLMB/FRW_TABPRO.
c) Choose 'Maintain'.
d) Enter the following new entries (table names):
/PLMB/FRW_FLDTYP
/PLMB/FRW_FLDTYT
/PLMB/FRW_MAPDTL
/PLMB/FRW_MAPFLD
/PLMB/FRW_PRM
/PLMB/GOS_SDEF
/PLMB/GOS_SDEFT
/PLMB/GOS_SGRP
/PLMB/VWR_VINST
/PLMU/FRW_CTXM
/PLMU/FRW_NAV
/PLMU/FRW_NAVTG
/PLMU/FRW_PREVW
EAML_D_OFFSET_TC
EAML_D_OFFSET_TT
EAMSC_UI_SHLP
EAMS_CVBATTMANAT
EAMS_CVBATTMANST
EAMS_CVBATTRMANA
EAMS_CVBATTRMANF
EAMS_CVBATTRMANS
EAMS_CVBOBJICON
EAMS_CVBOPT
EAMS_GENERAL_C
EAMS_UI_SHLP
EAMS_VVBSYSTS
EAMS_WD_CONFIG
GHO_NETOBJ_TYP_T
T003O
T003P
T157H
T158B
T350
T370F_T
T370P
T370U
T399W
T430
TCN2T
TCN41
TEAMS
TPMP
TQ80
TQ80_T
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BS_FND |
| Release 701 Until SAPK-70106INSAPBSFND |
------------------------------------------------------------------------
1. Create new messages.
a) Call transaction SE91.
b) Enter the message class /PLMB/BA_FRW.
c) Choose "Change".
d) Add message number 073:
"Tables (here: &1) with delivery class A cannot be read"
e) Add message number 074:
"Table &1 cannot be read"
f) Save the changes.
2. Create the table /PLMB/FRW_TABPRO.
a) Call transaction SE11.
b) Enter the table name /PLMB/FRW_TABPRO.
c) Choose 'Create'.
d) On the 'Delivery and Maintenance' tab page, choose the delivery class 'E' and choose 'Display/Maintenance Allowed' as the setting for 'Data Browser/Table View Maint.'.
e) Enter the field TABNAME with the data element TABNAME as a key field.
f) Choose 'Technical Settings' to maintain the technical settings of the table. Choose the following settings:
Data class = 'APPL2'
Size category = '0'
Buffering = 'Buffering switched on'
Buffering type = 'Fully Buffered'
g) Maintain the enhancement category by choosing 'Extras -> Enhancement Category...' and choose 'Cannot Be Enhanced'.
h) Save the change and assign the table to the package /PLMB/BA_FRW.
i) Activate the table.
j) Go to change mode.
k) On the 'Delivery and Maintenance' tab page, choose 'Maintain Customer Namespace' and for the key field TABNAME, set the entry 'Y*' and the entry 'Z*'.
l) Save the change.
3. Create a maintenance view.
a) Call transaction SE54.
b) Enter the table name /PLMB/FRW_TABPRO.
c) Choose 'Generated Objects'.
d) Choose 'Create/Change'.
e) Confirm the query.
f) Set the following parameters:
Authorization Group: &NC&
Function group: /PLMB/FRW_TABLES
Maintenance type One Step: X
Maint. Screen No. Overview screen: 101
g) Choose 'Create' (F6).
h) Save the changes.
4. Enter table names for the tables that can be accessed by the Table Provider.
a) Call transaction SM30.
b) Enter the table name /PLMB/FRW_TABPRO.
c) Choose 'Maintain'.
d) Enter the following new entries (table names):
/PLMB/FRW_FLDTYP
/PLMB/FRW_FLDTYT
/PLMB/FRW_MAPDTL
/PLMB/FRW_MAPFLD
/PLMB/FRW_PRM
/PLMB/GOS_SDEF
/PLMB/GOS_SDEFT
/PLMB/GOS_SGRP
/PLMB/VWR_VINST
/PLMU/FRW_CTXM
/PLMU/FRW_NAV
/PLMU/FRW_NAVTG
/PLMU/FRW_PREVW
Implement the corrections from the correction instructions.
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BS_FND |
| Release 702 Until SAPK-70202INSAPBSFND |
------------------------------------------------------------------------
1. Create new messages.
a) Call transaction SE91.
b) Enter the message class /PLMB/BA_FRW.
c) Choose "Change".
d) Add message number 073:
"Tables (here: &1) with delivery class A cannot be read"
e) Add message number 074:
"Table &1 cannot be read"
f) Save the changes.
2. Create the table /PLMB/FRW_TABPRO.
a) Call transaction SE11.
b) Enter the table name /PLMB/FRW_TABPRO.
c) Choose 'Create'.
d) On the 'Delivery and Maintenance' tab page, choose the delivery class 'E' and choose 'Display/Maintenance Allowed' as the setting for 'Data Browser/Table View Maint.'.
e) Enter the field TABNAME with the data element TABNAME as a key field.
f) Choose 'Technical Settings' to maintain the technical settings of the table. Choose the following settings:
Data class = 'APPL2'
Size category = '0'
Buffering = 'Buffering switched on'
Buffering type = 'Fully Buffered'
g) Maintain the enhancement category by choosing 'Extras -> Enhancement Category...' and choose 'Cannot Be Enhanced'.
h) Save the change and assign the table to the package /PLMB/BA_FRW.
i) Activate the table.
j) Go to change mode.
k) On the 'Delivery and Maintenance' tab page, choose 'Maintain Customer Namespace' and for the key field TABNAME, set the entry 'Y*' and the entry 'Z*'.
l) Save the change.
3. Create a maintenance view.
a) Call transaction SE54.
b) Enter the table name /PLMB/FRW_TABPRO.
c) Choose 'Generated Objects'.
d) Choose 'Create/Change'.
e) Confirm the query.
f) Set the following parameters:
Authorization Group: &NC&
Function group: /PLMB/FRW_TABLES
Maintenance type One Step: X
Maint. Screen No. Overview screen: 101
g) Choose 'Create' (F6).
h) Save the changes.
4. Enter table names for the tables that can be accessed by the Table Provider.
a) Call transaction SM30.
b) Enter the table name /PLMB/FRW_TABPRO.
c) Choose 'Maintain'.
d) Enter the following new entries (table names):
/PLMB/FRW_FLDTYP
/PLMB/FRW_FLDTYT
/PLMB/FRW_MAPDTL
/PLMB/FRW_MAPFLD
/PLMB/FRW_PRM
/PLMB/GOS_SDEF
/PLMB/GOS_SDEFT
/PLMB/GOS_SGRP
/PLMB/VWR_VINST
/PLMU/FRW_CTXM
/PLMU/FRW_NAV
/PLMU/FRW_NAVTG
/PLMU/FRW_PREVW
EAML_D_OFFSET_TC
EAML_D_OFFSET_TT
EAMSC_UI_SHLP
EAMS_CVBATTMANAT
EAMS_CVBATTMANST
EAMS_CVBATTRMANA
EAMS_CVBATTRMANF
EAMS_CVBATTRMANS
EAMS_CVBOBJICON
EAMS_CVBOPT
EAMS_GENERAL_C
EAMS_UI_SHLP
EAMS_VVBSYSTS
EAMS_WD_CONFIG
GHO_NETOBJ_TYP_T
T003O
T003P
T157H
T158B
T350
T370F_T
T370P
T370U
T399W
T430
TCN2T
TCN41
TEAMS
TPMP
TQ80
TQ80_T
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BS_FND |
| Release 701 Until SAPK-70106INSAPBSFND |
------------------------------------------------------------------------
1. Create new messages.
a) Call transaction SE91.
b) Enter the message class /PLMB/BA_FRW.
c) Choose "Change".
d) Add message number 073:
"Tables (here: &1) with delivery class A cannot be read"
e) Add message number 074:
"Table &1 cannot be read"
f) Save the changes.
2. Create the table /PLMB/FRW_TABPRO.
a) Call transaction SE11.
b) Enter the table name /PLMB/FRW_TABPRO.
c) Choose 'Create'.
d) On the 'Delivery and Maintenance' tab page, choose the delivery class 'E' and choose 'Display/Maintenance Allowed' as the setting for 'Data Browser/Table View Maint.'.
e) Enter the field TABNAME with the data element TABNAME as a key field.
f) Choose 'Technical Settings' to maintain the technical settings of the table. Choose the following settings:
Data class = 'APPL2'
Size category = '0'
Buffering = 'Buffering switched on'
Buffering type = 'Fully Buffered'
g) Maintain the enhancement category by choosing 'Extras -> Enhancement Category...' and choose 'Cannot Be Enhanced'.
h) Save the change and assign the table to the package /PLMB/BA_FRW.
i) Activate the table.
j) Go to change mode.
k) On the 'Delivery and Maintenance' tab page, choose 'Maintain Customer Namespace' and for the key field TABNAME, set the entry 'Y*' and the entry 'Z*'.
l) Save the change.
3. Create a maintenance view.
a) Call transaction SE54.
b) Enter the table name /PLMB/FRW_TABPRO.
c) Choose 'Generated Objects'.
d) Choose 'Create/Change'.
e) Confirm the query.
f) Set the following parameters:
Authorization Group: &NC&
Function group: /PLMB/FRW_TABLES
Maintenance type One Step: X
Maint. Screen No. Overview screen: 101
g) Choose 'Create' (F6).
h) Save the changes.
4. Enter table names for the tables that can be accessed by the Table Provider.
a) Call transaction SM30.
b) Enter the table name /PLMB/FRW_TABPRO.
c) Choose 'Maintain'.
d) Enter the following new entries (table names):
/PLMB/FRW_FLDTYP
/PLMB/FRW_FLDTYT
/PLMB/FRW_MAPDTL
/PLMB/FRW_MAPFLD
/PLMB/FRW_PRM
/PLMB/GOS_SDEF
/PLMB/GOS_SDEFT
/PLMB/GOS_SGRP
/PLMB/VWR_VINST
/PLMU/FRW_CTXM
/PLMU/FRW_NAV
/PLMU/FRW_NAVTG
/PLMU/FRW_PREVW
Ссылки
