Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1505000-5)
SAP Support Packages
(LACWPS_60_SP005_000006, LACWPS_60_SP999999_999999, SAP_LACWPS_50_SP008_000005, SAP_LACWPS_50_SP999999_999999)
Описание
This is due to certain outdated programming practices and coding errors which can result in exploiting sensitive information.
1) System internal data was being revealed as error messages to the end user. If this informtaiton can be accessed by a hacker, it can result in the program being exploited.
2) Presence of debug code used during the development phase may also provide an attacker with the opportunity to exploit sensitive information by finding loopholes.
3) Certain security critical implementation can also be exploited by hackers if the code contains random number generating functions which can be predicted once any of the previous values are retrieved. Such usage had to be removed from the code.
4) Scope of instance variables and methods also needed to be changed to avoid any chance of hackers being able to access the data which were assumed to be hidden.
These has been fixed in the following releases/patches of Live Auction:
LACWPS 6.0 Patch 6
LACWPS 5.0 Patch 5
1) System internal data was being revealed as error messages to the end user. If this informtaiton can be accessed by a hacker, it can result in the program being exploited.
2) Presence of debug code used during the development phase may also provide an attacker with the opportunity to exploit sensitive information by finding loopholes.
3) Certain security critical implementation can also be exploited by hackers if the code contains random number generating functions which can be predicted once any of the previous values are retrieved. Such usage had to be removed from the code.
4) Scope of instance variables and methods also needed to be changed to avoid any chance of hackers being able to access the data which were assumed to be hidden.
These has been fixed in the following releases/patches of Live Auction:
LACWPS 6.0 Patch 6
LACWPS 5.0 Patch 5
Как исправить
Please follow the manual instuctions relevant for your LAC installation attached with this note.
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SRM_SERVER |
| Release 550 All Support Package Levels |
| Release 500 All Support Package Levels |
| Release 600 All Support Package Levels |
| Release 700 All Support Package Levels |
| Release 701 All Support Package Levels |
------------------------------------------------------------------------
1. Go to the SAP Service Market Place.
2. Navigate to the SAP Support Portal.
3. Click on download tab.
4. Expand Support Packages and Patches.
5. Click on "Search for Support Packages and Patches." and then search for "LACWPS".
6. Download the latest support packages relevant for your installation and install.
LACWPS 6.0 Patch 6
LACWPS 5.0 Patch 5
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SRM_SERVER |
| Release 550 All Support Package Levels |
| Release 500 All Support Package Levels |
| Release 600 All Support Package Levels |
| Release 700 All Support Package Levels |
| Release 701 All Support Package Levels |
------------------------------------------------------------------------
1. Go to the SAP Service Market Place.
2. Navigate to the SAP Support Portal.
3. Click on download tab.
4. Expand Support Packages and Patches.
5. Click on "Search for Support Packages and Patches." and then search for "LACWPS".
6. Download the latest support packages relevant for your installation and install.
LACWPS 6.0 Patch 6
LACWPS 5.0 Patch 5
Ссылки
