Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1526102-3)
SAP Support Packages
(SAPK-60025INISH, SAPK-60214INISH, SAPK-60314INISH, SAPK-60415INISH, SAPK-60506INISH, SAPKIPHD56, SAPKIPHF41)
Описание
Reports in IS-H fail to correctly validate the path a user-submitted file is written to. Through this, an attacker can potentially overwrite data on the remote system.
Как исправить
Implement Supportpackage 04 for EHP5
Please refer to note 1497003 for additional information and instructions. The corrections from note 1497003 are a prerequisite for implementation of this note.
Each of the report mentioned below have a logical filename. The logical filename is identical with the report names.
IS-H does not supply a logical pathname. The logical pathnames have to be created by the customer and it has to be assigned to the logical filenames supplied by SAP.
Logical File Name Used in this Solution are deposited in the manual correction instruction.
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component IS-H IS-Hospital |
| Release 463B Until SAPKIPHD55 |
| Release 472 Until SAPKIPHF40 |
| Release 600 Until SAPK-60024INISH |
| Release 602 Until SAPK-60213INISH |
| Release 603 Until SAPK-60313INISH |
| Release 604 Until SAPK-60414INISH |
| Release 605 Until SAPK-60505INISH |
------------------------------------------------------------------------
Call transaction FILE
Double click 'Logical File Name Definition, Cross-Client' in the tree on the left side.
Press the button 'New Entries'
For each report name below, enter the following data. Please substitude <REPORTNAME>, do not enter the quotation marks:
Logical file: '<REPORTNAME>'
Name: 'Validation for <REPORTNAME>'
Data format: 'DIR'
Applicat. area: 'IS'
Press the button 'Next entry' (F8) and continue with next report.
Save your changes.
Report names
RNAICD50
RNAP21F01
RNC301C3
RNC301CHECKDATACOLLPOINTS
RNC301H3
RNC301T0
RNC302C0
RNCAMB00
RNCCHK02
RNCSDO00
RNIARZ01
RNIDEB01
RNIFID00
RNIGPA01
RNIKOS01
RNIKRH01
RNILST00
RNIMCONS0
RNNLLAZR
RNSKHSTATV2003
RNSKHSTATV2004
RNSKHSTATV2005
RNSKHSTATV2006
RNSKHSTATV2007
RNSSA9_2004
RNSSA9_2005
RNSSA9_2006
RNSSA9_2007
RNUDIAG2
RNUDIAG3
RNUDIAG4
RNUICPM4
RNUPLZSG
RNVPPR01
Please refer to note 1497003 for additional information and instructions. The corrections from note 1497003 are a prerequisite for implementation of this note.
Each of the report mentioned below have a logical filename. The logical filename is identical with the report names.
IS-H does not supply a logical pathname. The logical pathnames have to be created by the customer and it has to be assigned to the logical filenames supplied by SAP.
Logical File Name Used in this Solution are deposited in the manual correction instruction.
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component IS-H IS-Hospital |
| Release 463B Until SAPKIPHD55 |
| Release 472 Until SAPKIPHF40 |
| Release 600 Until SAPK-60024INISH |
| Release 602 Until SAPK-60213INISH |
| Release 603 Until SAPK-60313INISH |
| Release 604 Until SAPK-60414INISH |
| Release 605 Until SAPK-60505INISH |
------------------------------------------------------------------------
Call transaction FILE
Double click 'Logical File Name Definition, Cross-Client' in the tree on the left side.
Press the button 'New Entries'
For each report name below, enter the following data. Please substitude <REPORTNAME>, do not enter the quotation marks:
Logical file: '<REPORTNAME>'
Name: 'Validation for <REPORTNAME>'
Data format: 'DIR'
Applicat. area: 'IS'
Press the button 'Next entry' (F8) and continue with next report.
Save your changes.
Report names
RNAICD50
RNAP21F01
RNC301C3
RNC301CHECKDATACOLLPOINTS
RNC301H3
RNC301T0
RNC302C0
RNCAMB00
RNCCHK02
RNCSDO00
RNIARZ01
RNIDEB01
RNIFID00
RNIGPA01
RNIKOS01
RNIKRH01
RNILST00
RNIMCONS0
RNNLLAZR
RNSKHSTATV2003
RNSKHSTATV2004
RNSKHSTATV2005
RNSKHSTATV2006
RNSKHSTATV2007
RNSSA9_2004
RNSSA9_2005
RNSSA9_2006
RNSSA9_2007
RNUDIAG2
RNUDIAG3
RNUDIAG4
RNUICPM4
RNUPLZSG
RNVPPR01
Ссылки
