Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1499627-6)
SAP Support Packages
(SAPKH46C62, SAPKH47035, SAPKH50024, SAPKH60019, SAPKH60209, SAPKH60308, SAPKH60409, SAPKH60503)
Описание
The program code allows source code that can be determined freely to be added and executed, which enables an attacker to control the system response. Valid logon information is required for this.
The relevant program code must be stored in a database table. Therefore, an attacker requires authorization for transaction SE16 or SE16N as well as change authorization for the authorization object S_TABU_DIS.
With these authorizations, it is possible to make new entries in the tables because you have selected the "Display/Maintenance Allowed" option in the "Delivery and Maintenance" settings.
The relevant program code must be stored in a database table. Therefore, an attacker requires authorization for transaction SE16 or SE16N as well as change authorization for the authorization object S_TABU_DIS.
With these authorizations, it is possible to make new entries in the tables because you have selected the "Display/Maintenance Allowed" option in the "Delivery and Maintenance" settings.
Как исправить
Navigate to the table maintenance for the tables COTPLFS and COTPL, and change the setting on the "Delivery and Maintenance" tab page from "Display/Maintenance Allowed" to "Display/Maintenance Allowed with Restrictions", or import the relevant Support Package.
Then call transactions SE16 and SE16N for the tables COTPL and COTPLFS. It should no longer be possible to add or change entries.
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_APPL SAP Application |
| Release 46C Until SAPKH46C61 |
| Release 470 Until SAPKH47034 |
| Release 500 Until SAPKH50023 |
| Release 600 Until SAPKH60018 |
| Release 602 Until SAPKH60208 |
| Release 603 Until SAPKH60307 |
| Release 604 Until SAPKH60408 |
| Release 605 Until SAPKH60502 |
------------------------------------------------------------------------
Navigate to the table maintenance for the tables COTPLFS and COTPL, and change the setting on the "Delivery and Maintenance" tab page from "Display/Maintenance Allowed" to "Display/Maintenance Allowed with Restrictions", or import the relevant Support Package.
Then call transactions SE16 and SE16N for the tables COTPL and COTPLFS. It should no longer be possible to add or change entries.
Then call transactions SE16 and SE16N for the tables COTPL and COTPLFS. It should no longer be possible to add or change entries.
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_APPL SAP Application |
| Release 46C Until SAPKH46C61 |
| Release 470 Until SAPKH47034 |
| Release 500 Until SAPKH50023 |
| Release 600 Until SAPKH60018 |
| Release 602 Until SAPKH60208 |
| Release 603 Until SAPKH60307 |
| Release 604 Until SAPKH60408 |
| Release 605 Until SAPKH60502 |
------------------------------------------------------------------------
Navigate to the table maintenance for the tables COTPLFS and COTPL, and change the setting on the "Delivery and Maintenance" tab page from "Display/Maintenance Allowed" to "Display/Maintenance Allowed with Restrictions", or import the relevant Support Package.
Then call transactions SE16 and SE16N for the tables COTPL and COTPLFS. It should no longer be possible to add or change entries.
Ссылки
