Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1531288-2)
SAP Support Packages
(SAPK-470B4INSAPHRRXX, SAPK-470B5INSAPHRRXX, SAPK-50080INSAPHRRXX, SAPK-50081INSAPHRRXX, SAPK-60063INSAPHRRXX, SAPK-60064INSAPHRRXX, SAPK-60429INSAPHRRXX, SAPK-60430INSAPHRRXX, SAPKE40BH1, SAPKE45BF5, SAPKE46BE1, SAPKE46CG9, SAPKE46CH0)
Описание
HR Distributed-Reporting does not contain authorization checks for checking an authenticated user's authorization to access some of its functions. This may result in undesired system behavior.
Как исправить
Implement the corresponding Support Package. As alternative implement the corresponding correction instructions.
The relationship between the technical name and the HR Support Package you will find in SAP note 1232082.
Delivery with End of Year Support Packages:
SAP_HR 46C SAPKE46CG9
SAP_HRRXX 470 SAPKE470B4
SAP_HRRXX 500 SAPKE50080
SAP_HRRXX 600 SAPKE60063
SAP_HRRXX 604 SAPKE60429
The mentioned Support Packages will contain the Business Addin HRPAD00AUTH_DIST with a default implementation restricting the executable reports to reports using HR logical databases. To change the default behaviour you need to replace the default implementation by creation of a customer implementation.
In these SPs the source code contains an authority check against S_PROGRAM. This will be deleted with the following SPs since it is not needed. In case you have implemented the first SP SAP strongly recommends to implement the correction instruction.
Delivery with XMAS Support Packages:
SAP_HR 46C SAPKE46CH0
SAP_HRRXX 470 SAPKE470B5
SAP_HRRXX 500 SAPKE50081
SAP_HRRXX 600 SAPKE60064
SAP_HRRXX 604 SAPKE60430
The mentioned support packages will contain the customizing table HRAUTH_DIST_REP that allows adding reports for execution that do not use the HR logical databases. Needed entries for SAP Standard programs will be delivered. Entries for customer programs need to be created.
For releases prior 4.6C please apply the attached correction instructions.
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_HR R/3 Standard Hu...|
| Release 46C SAPKE46CG9 - SAPKE46CG9 |
------------------------------------------------------------------------
Create database table HRAUTH_DIST_REP using transaction SE11:
Package: BAS Delivery Class: C Data Browser/Table View Maint. X Display/Maint. Allowed Field Key Data Element MANDT X MANDT NAME X PROGNAME Foreign key value: TRDIR (use default values)
Tehnical Settings:
Data Class: APPL2 Size Category: 0 Biffering: Buffering switched on Buffering Type:Generic Area Buffered; No.of key fields:1
Generate Table Maintenance dialog (view) V_HRAUTH_DIST_R for the table
HRAUTH_DIST_REP using transaction SE54:
Authorization Group: PC Function Group: HRAUTH Package: PBAS Maintenance type: one step Mainten. screen No.: Overview screen: 2 Recording routine: Standard recording routine
After activation of view V_HRAUTH_DIST_R please use transaction SM30 to create entry for report RPCBDHD0_OUT in the table HRAUTH_DIST_REP.
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_HRRXX SAP HR Reused F...|
| Release 470 SAPK-470B4INSAPHRRXX - SAPK-470B4INSAPHRRXX |
| Release 500 SAPK-50080INSAPHRRXX - SAPK-50080INSAPHRRXX |
| Release 600 SAPK-60063INSAPHRRXX - SAPK-60063INSAPHRRXX |
| Release 604 SAPK-60429INSAPHRRXX - SAPK-60429INSAPHRRXX |
------------------------------------------------------------------------
Create database table HRAUTH_DIST_REP using transaction SE11:
Package: BAS Delivery Class: C Data Browser/Table View Maint. X Display/Maint. Allowed Field Key Data Element MANDT X MANDT NAME X PROGNAME Foreign key value: TRDIR (use default values)
Tehnical Settings:
Data Class: APPL2 Size Category: 0 Biffering: Buffering switched on Buffering Type:Generic Area Buffered; No.of key fields:1
Generate Table Maintenance dialog (view) V_HRAUTH_DIST_R for the table HRAUTH_DIST_REP using transaction SE54:
Authorization Group: PC Function Group: HRAUTH Package: PBAS Maintenance type: one step Mainten. screen No.: Overview screen: 2 Recording routine: Standard recording routine
After activation of view V_HRAUTH_DIST_R please use transaction SM30 to create entry for report RPCBDHD0_OUT in the table HRAUTH_DIST_REP.
The relationship between the technical name and the HR Support Package you will find in SAP note 1232082.
Delivery with End of Year Support Packages:
SAP_HR 46C SAPKE46CG9
SAP_HRRXX 470 SAPKE470B4
SAP_HRRXX 500 SAPKE50080
SAP_HRRXX 600 SAPKE60063
SAP_HRRXX 604 SAPKE60429
The mentioned Support Packages will contain the Business Addin HRPAD00AUTH_DIST with a default implementation restricting the executable reports to reports using HR logical databases. To change the default behaviour you need to replace the default implementation by creation of a customer implementation.
In these SPs the source code contains an authority check against S_PROGRAM. This will be deleted with the following SPs since it is not needed. In case you have implemented the first SP SAP strongly recommends to implement the correction instruction.
Delivery with XMAS Support Packages:
SAP_HR 46C SAPKE46CH0
SAP_HRRXX 470 SAPKE470B5
SAP_HRRXX 500 SAPKE50081
SAP_HRRXX 600 SAPKE60064
SAP_HRRXX 604 SAPKE60430
The mentioned support packages will contain the customizing table HRAUTH_DIST_REP that allows adding reports for execution that do not use the HR logical databases. Needed entries for SAP Standard programs will be delivered. Entries for customer programs need to be created.
For releases prior 4.6C please apply the attached correction instructions.
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_HR R/3 Standard Hu...|
| Release 46C SAPKE46CG9 - SAPKE46CG9 |
------------------------------------------------------------------------
Create database table HRAUTH_DIST_REP using transaction SE11:
Package: BAS Delivery Class: C Data Browser/Table View Maint. X Display/Maint. Allowed Field Key Data Element MANDT X MANDT NAME X PROGNAME Foreign key value: TRDIR (use default values)
Tehnical Settings:
Data Class: APPL2 Size Category: 0 Biffering: Buffering switched on Buffering Type:Generic Area Buffered; No.of key fields:1
Generate Table Maintenance dialog (view) V_HRAUTH_DIST_R for the table
HRAUTH_DIST_REP using transaction SE54:
Authorization Group: PC Function Group: HRAUTH Package: PBAS Maintenance type: one step Mainten. screen No.: Overview screen: 2 Recording routine: Standard recording routine
After activation of view V_HRAUTH_DIST_R please use transaction SM30 to create entry for report RPCBDHD0_OUT in the table HRAUTH_DIST_REP.
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_HRRXX SAP HR Reused F...|
| Release 470 SAPK-470B4INSAPHRRXX - SAPK-470B4INSAPHRRXX |
| Release 500 SAPK-50080INSAPHRRXX - SAPK-50080INSAPHRRXX |
| Release 600 SAPK-60063INSAPHRRXX - SAPK-60063INSAPHRRXX |
| Release 604 SAPK-60429INSAPHRRXX - SAPK-60429INSAPHRRXX |
------------------------------------------------------------------------
Create database table HRAUTH_DIST_REP using transaction SE11:
Package: BAS Delivery Class: C Data Browser/Table View Maint. X Display/Maint. Allowed Field Key Data Element MANDT X MANDT NAME X PROGNAME Foreign key value: TRDIR (use default values)
Tehnical Settings:
Data Class: APPL2 Size Category: 0 Biffering: Buffering switched on Buffering Type:Generic Area Buffered; No.of key fields:1
Generate Table Maintenance dialog (view) V_HRAUTH_DIST_R for the table HRAUTH_DIST_REP using transaction SE54:
Authorization Group: PC Function Group: HRAUTH Package: PBAS Maintenance type: one step Mainten. screen No.: Overview screen: 2 Recording routine: Standard recording routine
After activation of view V_HRAUTH_DIST_R please use transaction SM30 to create entry for report RPCBDHD0_OUT in the table HRAUTH_DIST_REP.
Ссылки
