Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1532960-2)
SAP Support Packages
(SAPK-20004INFUNDMGMT)
Описание
A gap in the program design contained in the attached correction instructions permits a user to read arbitrary files on the network and permits unauthorized access to confidential information.
An additional gap in the design in some programs (see the attached correction instructions) permits the user to write arbitrary files on the network and represents a security risk.
For additional detail about the basic problem, see Note 1497003.
An additional gap in the design in some programs (see the attached correction instructions) permits the user to write arbitrary files on the network and represents a security risk.
For additional detail about the basic problem, see Note 1497003.
Как исправить
Implement the attached correction instructions or import the relevant Support Package.
The corrections provided in Note 1497003 are a prerequisite for implementing this note. If you implement the corrections from this note only without the corrections from Note 1497003, the relevant functions are still active. However, in this case, the file names are not validated.
When you implement the corrections from this note, the logical file names and file paths described in the manual advance tasks are introduced to validate the input data. The specific physical file paths that belong to the logical file names must be adjusted by the system administration according to requirements.
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component FUNDMGMT |
| Release 200 SAPK-20003INFUNDMGMT - SAPK-20003INFUNDMGMT |
------------------------------------------------------------------------
Create the following client-independent logical file paths:
/TXS/ABS_EXPORT (Securitization: Export of files)
/TXS/ABS_IMPORT (Securitization: Import of files)
Maintain the assignment to physical file paths according to the specifications of your system administration.
Create the following definition of logical file names (client-independent):
/TXS/ABS_EXPORT_OFFER (Securitization: Export offer)
/TXS/ABS_EXPORT_PORTFOLIO (Securitization: Export portfolio)
/TXS/ABS_IMPORT_PORTFOLIO (Securitization: Import portfolio)
/TXS/ABS_IMPORT_SALE (Securitization: Import sale)
For all file names, enter the data format "DIR" (check directory for validation of file names) and enter the logical path /TXS/ABS_EXPORT and /TXS/ABS_IMPORT. The physical file name remains empty.
The corrections provided in Note 1497003 are a prerequisite for implementing this note. If you implement the corrections from this note only without the corrections from Note 1497003, the relevant functions are still active. However, in this case, the file names are not validated.
When you implement the corrections from this note, the logical file names and file paths described in the manual advance tasks are introduced to validate the input data. The specific physical file paths that belong to the logical file names must be adjusted by the system administration according to requirements.
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component FUNDMGMT |
| Release 200 SAPK-20003INFUNDMGMT - SAPK-20003INFUNDMGMT |
------------------------------------------------------------------------
Create the following client-independent logical file paths:
/TXS/ABS_EXPORT (Securitization: Export of files)
/TXS/ABS_IMPORT (Securitization: Import of files)
Maintain the assignment to physical file paths according to the specifications of your system administration.
Create the following definition of logical file names (client-independent):
/TXS/ABS_EXPORT_OFFER (Securitization: Export offer)
/TXS/ABS_EXPORT_PORTFOLIO (Securitization: Export portfolio)
/TXS/ABS_IMPORT_PORTFOLIO (Securitization: Import portfolio)
/TXS/ABS_IMPORT_SALE (Securitization: Import sale)
For all file names, enter the data format "DIR" (check directory for validation of file names) and enter the logical path /TXS/ABS_EXPORT and /TXS/ABS_IMPORT. The physical file name remains empty.
Ссылки
