Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1512352-6)
SAP Support Packages
(SAPKA62070, SAPKA64028, SAPKA70024, SAPKA70109, SAPKA70207, SAPKA71012, SAPKA71107, SAPKA73002, SAPKH31IB9, SAPKH40B89, SAPKH45B67, SAPKH46B62, SAPKH46C62)
Описание
The reports RCCTBI01, RCCTBISC, RCCLDI01, RCCLBI01, RCCLBI02, RCCLBI03, RCCLBISC, and RCCLBISH fail to correctly validate the path a user-submitted file is written to. This means that an attacker can potentially overwrite data on the remote system.
Как исправить
Implement the changes in accordance with the advance correction.
Also refer to the information contained in Note 1497003. The program changes from Note 1497003 are also a prerequisite for this note.
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_APPL SAP Application |
| Release 31I Until SAPKH31IB8 |
| Release 40B Until SAPKH40B88 |
| Release 45B Until SAPKH45B66 |
| Release 46B Until SAPKH46B61 |
| Release 46C Until SAPKH46C61 |
------------------------------------------------------------------------
For the function modules CLBA_CLASSIF_FILE_REMOTE_HOST, CLBA_UPDATE_FILE_REMOTE_HOST, and CTB1_GET_DATA_FROM_REMOTE_HOST, create the following import parameters:
Parameter name : LOGICAL_FILENAME
Typing: TYPE
Associated type: FILENAME-FILEINTERN
Select the "Optional" and "Pass Value" settings.
Add the following exceptions:
LOGICAL_FILENAME_NOT_FOUND with the short text "Invalid name"
VALIDATION_FAILED with the short text "File name does not meet specifications".
Create the following selection text for the report RCCLBI03:
Name: P_ERRFIL
Text: Path name
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_ABA SAP Application...|
| Release 620 Until SAPKA62054 |
| Release 640 Until SAPKA64012 |
------------------------------------------------------------------------
For the function modules CLBA_CLASSIF_FILE_REMOTE_HOST, CLBA_UPDATE_FILE_REMOTE_HOST, and CTB1_GET_DATA_FROM_REMOTE_HOST, create the following import parameters:
Parameter name : LOGICAL_FILENAME
Typing: TYPE
Associated type: FILENAME-FILEINTERN
Select the "Optional" and "Pass Value" settings.
Add the following exceptions:
LOGICAL_FILENAME_NOT_FOUND with the short text "Invalid name"
VALIDATION_FAILED with the short text "File name does not meet specifications".
Also refer to the information contained in Note 1497003. The program changes from Note 1497003 are also a prerequisite for this note.
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_APPL SAP Application |
| Release 31I Until SAPKH31IB8 |
| Release 40B Until SAPKH40B88 |
| Release 45B Until SAPKH45B66 |
| Release 46B Until SAPKH46B61 |
| Release 46C Until SAPKH46C61 |
------------------------------------------------------------------------
For the function modules CLBA_CLASSIF_FILE_REMOTE_HOST, CLBA_UPDATE_FILE_REMOTE_HOST, and CTB1_GET_DATA_FROM_REMOTE_HOST, create the following import parameters:
Parameter name : LOGICAL_FILENAME
Typing: TYPE
Associated type: FILENAME-FILEINTERN
Select the "Optional" and "Pass Value" settings.
Add the following exceptions:
LOGICAL_FILENAME_NOT_FOUND with the short text "Invalid name"
VALIDATION_FAILED with the short text "File name does not meet specifications".
Create the following selection text for the report RCCLBI03:
Name: P_ERRFIL
Text: Path name
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_ABA SAP Application...|
| Release 620 Until SAPKA62054 |
| Release 640 Until SAPKA64012 |
------------------------------------------------------------------------
For the function modules CLBA_CLASSIF_FILE_REMOTE_HOST, CLBA_UPDATE_FILE_REMOTE_HOST, and CTB1_GET_DATA_FROM_REMOTE_HOST, create the following import parameters:
Parameter name : LOGICAL_FILENAME
Typing: TYPE
Associated type: FILENAME-FILEINTERN
Select the "Optional" and "Pass Value" settings.
Add the following exceptions:
LOGICAL_FILENAME_NOT_FOUND with the short text "Invalid name"
VALIDATION_FAILED with the short text "File name does not meet specifications".
Ссылки
