Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1510407-3)
SAP Support Packages
(SAPK-60025INISH, SAPK-60214INISH, SAPK-60314INISH, SAPK-60415INISH, SAPK-60504INISH, SAPK-60505INISH, SAPKIPHD56, SAPKIPHF40, SAPKIPHF41)
Описание
Reports in IS-H fail to correctly validate the path a user-submitted file is written to. Through this, an attacker can potentially overwrite data on the remote system.
Как исправить
Implement Supportpackage 04 for EHP5
Please refer to note 1497003 for additional information and instructions. The corrections from note 1497003 are a prerequisite for implementation of this note.
Each of the report mentioned below have a logical filename. The logical filename is identical with the report names.
IS-H does not supply a logical pathname. The logical pathnames have to be created by the customer and it has to be assigned to the logical filenames supplied by SAP.
Logical File Name Used in this Solution are deposited in the manual correction instruction.
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component IS-H IS-Hospital |
| Release 463B Until SAPKIPHD55 |
| Release 472 SAPKIPHF31 - SAPKIPHF39 |
| Release 603 SAPK-60310INISH - SAPK-60313INISH |
| Release 604 SAPK-60410INISH - SAPK-60414INISH |
------------------------------------------------------------------------
Call transaction FILE
Double click 'Logical File Name Definition, Cross-Client' in the tree on the left side.
Press the button 'New Entries'
For each report name below, enter the following data. Please substitude <REPORTNAME>, do not enter the quotation marks:
Logical file: '<REPORTNAME>'
Name: 'Validation for <REPORTNAME>'
Data format: 'DIR'
Applicat. area: 'IS'
Press the button 'Next entry' (F8) and continue with next report.
Save your changes.
Report names:
RNABDT00
RNCTT002
RNILOE00
RNILST01
RNNLLMR1
RNUEZG50
RNUICD50
RNUPLZ50
RNWATSTERNKR_LOAD
RNWCHBI00
RNWCHBI10
/ISHFR/RNWFRCCAM_LOAD
/ISHFR/RNWFRGHM_LOAD
/ISHFR/RNWFRGHS_LOAD
/ISHFR/RNWFRGHT_LOAD
/ISHFR/RNWFRRPPS_LOAD
/ISHFR/RNWFRUCD_LOAD
/ISHFR/RNWFRUICMD
RN1_CORRECT_APP_ORGFA
RN1_CORRECT_OP_ANCHOR_ORGFA
RN1_CORRECT_STXH_N1DCS001
/ISHFR/RNWFRLPP_LOAD
/ISHFR/RNWFRNABM_LOAD
RNWATMELBI
RNWATMELZUO
RNWATSTERNKR_LOAD
RNWAT_LKF_GRUPPEN
RNWAT_SCO_HOECHST
Please refer to note 1497003 for additional information and instructions. The corrections from note 1497003 are a prerequisite for implementation of this note.
Each of the report mentioned below have a logical filename. The logical filename is identical with the report names.
IS-H does not supply a logical pathname. The logical pathnames have to be created by the customer and it has to be assigned to the logical filenames supplied by SAP.
Logical File Name Used in this Solution are deposited in the manual correction instruction.
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component IS-H IS-Hospital |
| Release 463B Until SAPKIPHD55 |
| Release 472 SAPKIPHF31 - SAPKIPHF39 |
| Release 603 SAPK-60310INISH - SAPK-60313INISH |
| Release 604 SAPK-60410INISH - SAPK-60414INISH |
------------------------------------------------------------------------
Call transaction FILE
Double click 'Logical File Name Definition, Cross-Client' in the tree on the left side.
Press the button 'New Entries'
For each report name below, enter the following data. Please substitude <REPORTNAME>, do not enter the quotation marks:
Logical file: '<REPORTNAME>'
Name: 'Validation for <REPORTNAME>'
Data format: 'DIR'
Applicat. area: 'IS'
Press the button 'Next entry' (F8) and continue with next report.
Save your changes.
Report names:
RNABDT00
RNCTT002
RNILOE00
RNILST01
RNNLLMR1
RNUEZG50
RNUICD50
RNUPLZ50
RNWATSTERNKR_LOAD
RNWCHBI00
RNWCHBI10
/ISHFR/RNWFRCCAM_LOAD
/ISHFR/RNWFRGHM_LOAD
/ISHFR/RNWFRGHS_LOAD
/ISHFR/RNWFRGHT_LOAD
/ISHFR/RNWFRRPPS_LOAD
/ISHFR/RNWFRUCD_LOAD
/ISHFR/RNWFRUICMD
RN1_CORRECT_APP_ORGFA
RN1_CORRECT_OP_ANCHOR_ORGFA
RN1_CORRECT_STXH_N1DCS001
/ISHFR/RNWFRLPP_LOAD
/ISHFR/RNWFRNABM_LOAD
RNWATMELBI
RNWATMELZUO
RNWATSTERNKR_LOAD
RNWAT_LKF_GRUPPEN
RNWAT_SCO_HOECHST
Ссылки
