Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1511612-4)
SAP Support Packages
(SAPKB46B62, SAPKB46C62, SAPKB62070, SAPKB64027, SAPKB70023, SAPKB70108, SAPKB70206, SAPKB71012, SAPKB71106, SAPKB72004, SAPKB73001, SAPKB73002, SAPKH31IB9, SAPKH40B89, SAPKH45B67)
Описание
In transaction ST06 or transaction ST06N you can call and display hardware configuration information via an application server. This data is created by the operating system collector saposcol and saved in a file. This file is read via a function module and displayed by transaction ST06 or transaction ST06N. However, with the relevant authorization, the function module can also be used to read files that are accessible for the user with which the relevant application server runs (normally the user <sid>adm).
The attached patch suppresses this option. Before the requested file is read, the function module now checks whether this file contains hardware configuration data that was created by saposcol.
By default, this takes place via a standard communication channel to saposcol, where the file that is to be read is confirmed. A slight delay may occur here depending on the number of queries of this or a similar type that saposcol must process. This slight delay does not normally pose a problem.
If you want to prevent the query to saposcol, you can set the profile parameter 'saposcol/workdir' to specify a list of directories (separated by semicolons) from which reading the hardware configuration data is permitted.
Normally, this list contains only one entry: The saposcol work directory (for example, /usr/sap/tmp (UNIX), \\<host>\saploc\prfclog (Windows), or if you use the saphostagent /usr/sap/hostctrl/work (UNIX) or %ProgramFiles%\SAP\hostctrl\work).
If the profile parameter 'saposcol/workdir' is set, the query to saposcol is prevented when the system reads the hardware configuration file. Instead, the system checks whether the file that is to be read is located in the specified directory. Reading is permitted only if this is the case.
The attached patch suppresses this option. Before the requested file is read, the function module now checks whether this file contains hardware configuration data that was created by saposcol.
By default, this takes place via a standard communication channel to saposcol, where the file that is to be read is confirmed. A slight delay may occur here depending on the number of queries of this or a similar type that saposcol must process. This slight delay does not normally pose a problem.
If you want to prevent the query to saposcol, you can set the profile parameter 'saposcol/workdir' to specify a list of directories (separated by semicolons) from which reading the hardware configuration data is permitted.
Normally, this list contains only one entry: The saposcol work directory (for example, /usr/sap/tmp (UNIX), \\<host>\saploc\prfclog (Windows), or if you use the saphostagent /usr/sap/hostctrl/work (UNIX) or %ProgramFiles%\SAP\hostctrl\work).
If the profile parameter 'saposcol/workdir' is set, the query to saposcol is prevented when the system reads the hardware configuration file. Instead, the system checks whether the file that is to be read is located in the specified directory. Reading is permitted only if this is the case.
Как исправить
Implement the relevant correction instructions or import the relevant Support Package.
Ссылки
