Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
(AV:N/AC:M/AU:N/C:P/I:N/A:N)
Производитель ПО
Наименование ПО
SAP Notes
(1687334-9)
SAP Support Packages
(SAPKB70027, SAPKB70028, SAPKB70112, SAPKB70212, SAPKB71015, SAPKB71016, SAPKB71110, SAPKB72008, SAPKB73008, SAPKB73104, SAPKB73105)
Описание
Web services configured to use XML Encryption. Web services using SSL are not affected.
Как исправить
In NW ABAP 7.20, the correction disables the use of XML Encryption in web services. In other releases use report WSS_ENCTYPTION_CHECK attached to this message to check if your system is using XML Encryption. In case your system is affected, please implement the correction instructions attached to this note. As an alternative, you may reconfigure the affected web services to use SSL for transport protection instead of XML Encryption.
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 700 SAPKB70023 - SAPKB70026 |
------------------------------------------------------------------------
1. Change structure SEC_DSIG_SIGNATURE: Transaction SE11
Add new Component
Field Name C14N_SIGNEDINFO
Data type RAWSTRING
Activate the structure. Ignore the warning.
2. Create database table SEC_ST_REPLAY_DB: Transaction SE11
Short Description Table for replay detection
Table category Transparent table
Package SOAP_SECURITY
Delivery class L
Data class APPL1
Size category 3
Buffering not allowed
Enhancement Cannot Be Enhanced
Components
Field Name ID
Data type CHAR
Length 255
Key
Field Name TR_ID
Data type CHAR
Length 32
Field Name LOCATION
Data type CHAR
Length 1
Field Name CREATED
Data element TIMESTAMP
Field Name EXPIRES
Data element TIMESTAMP
Field Name UNAME
Data element XUBNAME
Activate the table. Ignore the warning.
3.Create / change messages WSS 019 and WSS 051: Transaction SE80
Package SOAP_SECURITY - Message class WSS
019 = 'Signature check failed - WP: &1 SSF_PAB: &2'
051 = 'XML decryption key &1 found in SEC_ST_REPLAY_DB'
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 710 SAPKB71011 - SAPKB71014 |
------------------------------------------------------------------------
1. Change structure SEC_DSIG_SIGNATURE: Transaction SE11
Add new Component
Field Name C14N_SIGNEDINFO
Data type RAWSTRING
Activate the structure. Ignore the warning.
2. Create database table SEC_ST_REPLAY_DB: Transaction SE11
Short Description Table for replay detection
Table category Transparent table
Package SOAP_SECURITY
Delivery class L
Data class APPL1
Size category 3
Buffering not allowed
Enhancement Cannot Be Enhanced
Components
Field Name ID
Data type CHAR
Length 255
Key
Field Name TR_ID
Data type CHAR
Length 32
Field Name LOCATION
Data type CHAR
Length 1
Field Name CREATED
Data element TIMESTAMP
Field Name EXPIRES
Data element TIMESTAMP
Field Name UNAME
Data element XUBNAME
Activate the table. Ignore the warning.
3.Create / change messages WSS 019 and WSS 051: Transaction SE80
Package SOAP_SECURITY - Message class WSS
019 = 'Signature check failed - WP: &1 SSF_PAB: &2'
051 = 'XML decryption key &1 found in SEC_ST_REPLAY_DB'
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 711 SAPKB71106 - SAPKB71109 |
------------------------------------------------------------------------
1. Create database table SEC_ST_REPLAY_DB: Transaction SE11
Short Description Table for replay detection
Table category Transparent table
Package SOAP_SECURITY
Delivery class L
Data class APPL1
Size category 3
Buffering not allowed
Enhancement Cannot Be Enhanced
Components
Field Name ID
Data type CHAR
Length 255
Key
Field Name TR_ID
Data type CHAR
Length 32
Field Name LOCATION
Data type CHAR
Length 1
Field Name CREATED
Data element TIMESTAMP
Field Name EXPIRES
Data element TIMESTAMP
Field Name UNAME
Data element XUBNAME
Activate the table. Ignore the warning.
2.Create / change messages WSS 019 and WSS 051: Transaction SE80
Package SOAP_SECURITY - Message class WSS
019 = 'Signature check failed - WP: &1 SSF_PAB: &2'
051 = 'XML decryption key &1 found in SEC_ST_REPLAY_DB'
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 731 SAPKB73101 - SAPKB73103 |
------------------------------------------------------------------------
1.Create / change messages WSS 019 and WSS 051: Transaction SE80
Package SOAP_SECURITY - Message class WSS
019 = 'Signature check failed - WP: &1 SSF_PAB: &2'
051 = 'XML decryption key &1 found in SEC_ST_REPLAY_DB'
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 700 SAPKB70023 - SAPKB70026 |
------------------------------------------------------------------------
1 Create texts for report WSS_SETUP: Transaction SE38
Text symbol: 002 = WS Security Options
Selection text: C_CBC = Detect XML CBC attack
2 Create texts for report WSSE_TOKEN_CACHE_CLEANUP:
Selection text: LIFETIME = Lifetime in sec
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 702 SAPKB70205 - SAPKB70211 |
------------------------------------------------------------------------
1 Create texts for report WSS_SETUP: Transaction SE38
Selection text: C_CBC = Detect XML CBC attack
2 Create texts for report WSSE_TOKEN_CACHE_CLEANUP:
Selection text: LIFETIME = Lifetime in sec
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 710 SAPKB71011 - SAPKB71014 |
------------------------------------------------------------------------
1 Create texts for report WSS_SETUP: Transaction SE38
Text symbol: 002 = WS Security Options
Selection text: C_CBC = Detect XML CBC attack
2 Create texts for report WSSE_TOKEN_CACHE_CLEANUP:
Selection text: LIFETIME = Lifetime in sec
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 711 SAPKB71106 - SAPKB71109 |
------------------------------------------------------------------------
1 Create texts for report WSS_SETUP: Transaction SE38
Selection text: C_CBC = Detect XML CBC attack
2 Create texts for report WSSE_TOKEN_CACHE_CLEANUP:
Selection text: LIFETIME = Lifetime in sec
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 730 SAPKB73001 - SAPKB73007 |
------------------------------------------------------------------------
1 Create texts for report WSS_SETUP: Transaction SE38
Selection text: C_CBC = Detect XML CBC attack
2 Create texts for report WSSE_TOKEN_CACHE_CLEANUP:
Selection text: LIFETIME = Lifetime in sec
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 701 SAPKB70108 - SAPKB70111 |
------------------------------------------------------------------------
1 Create texts for report WSS_SETUP: Transaction SE38
Text symbol: 002 = WS Security Options
Selection text: C_CBC = Detect XML CBC attack
2 Create texts for report WSSE_TOKEN_CACHE_CLEANUP:
Selection text: LIFETIME = Lifetime in sec
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 731 SAPKB73101 - SAPKB73103 |
------------------------------------------------------------------------
1 Create texts for report WSS_SETUP: Transaction SE38
Text symbol: 002 = WS Security Options
Selection text: C_CBC = Detect XML CBC attack
2 Create texts for report WSSE_TOKEN_CACHE_CLEANUP:
Selection text: LIFETIME = Lifetime in sec
------------------------------------------------------------------------
|Manual Activity |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 701 SAPKB70108 - SAPKB70111 |
------------------------------------------------------------------------
1. Create database table SEC_ST_REPLAY_DB: Transaction SE11
Short Description Table for replay detection
Table category Transparent table
Package SOAP_SECURITY
Delivery class L
Data class APPL1
Size category 3
Buffering not allowed
Enhancement Cannot Be Enhanced
Components
Field Name ID
Data type CHAR
Length 255
Key
Field Name TR_ID
Data type CHAR
Length 32
Field Name LOCATION
Data type CHAR
Length 1
Field Name CREATED
Data element TIMESTAMP
Field Name EXPIRES
Data element TIMESTAMP
Field Name UNAME
Data element XUBNAME
Activate the table. Ignore the warning.
2.Create / change messages WSS 019 and WSS 051: Transaction SE80
Package SOAP_SECURITY - Message class WSS
019 = 'Signature check failed - WP: &1 SSF_PAB: &2'
051 = 'XML decryption key &1 found in SEC_ST_REPLAY_DB'
------------------------------------------------------------------------
|Manual Activity |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 701 SAPKB70108 - SAPKB70111 |
------------------------------------------------------------------------
------------------------------------------------------------------------
|Manual Activity |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 731 SAPKB73101 - SAPKB73103 |
------------------------------------------------------------------------
------------------------------------------------------------------------
|Manual Activity |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 730 SAPKB73001 - SAPKB73007 |
------------------------------------------------------------------------
1.Create / change messages WSS 019 and WSS 051: Transaction SE80
Package SOAP_SECURITY - Message class WSS
019 = 'Signature check failed - WP: &1 SSF_PAB: &2'
051 = 'XML decryption key &1 found in SEC_ST_REPLAY_DB'
------------------------------------------------------------------------
|Manual Activity |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 702 SAPKB70205 - SAPKB70211 |
------------------------------------------------------------------------
1.Create / change messages WSS 019 and WSS 051: Transaction SE80
Package SOAP_SECURITY - Message class WSS
019 = 'Signature check failed - WP: &1 SSF_PAB: &2'
051 = 'XML decryption key &1 found in SEC_ST_REPLAY_DB'
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 700 SAPKB70023 - SAPKB70026 |
------------------------------------------------------------------------
1. Change structure SEC_DSIG_SIGNATURE: Transaction SE11
Add new Component
Field Name C14N_SIGNEDINFO
Data type RAWSTRING
Activate the structure. Ignore the warning.
2. Create database table SEC_ST_REPLAY_DB: Transaction SE11
Short Description Table for replay detection
Table category Transparent table
Package SOAP_SECURITY
Delivery class L
Data class APPL1
Size category 3
Buffering not allowed
Enhancement Cannot Be Enhanced
Components
Field Name ID
Data type CHAR
Length 255
Key
Field Name TR_ID
Data type CHAR
Length 32
Field Name LOCATION
Data type CHAR
Length 1
Field Name CREATED
Data element TIMESTAMP
Field Name EXPIRES
Data element TIMESTAMP
Field Name UNAME
Data element XUBNAME
Activate the table. Ignore the warning.
3.Create / change messages WSS 019 and WSS 051: Transaction SE80
Package SOAP_SECURITY - Message class WSS
019 = 'Signature check failed - WP: &1 SSF_PAB: &2'
051 = 'XML decryption key &1 found in SEC_ST_REPLAY_DB'
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 710 SAPKB71011 - SAPKB71014 |
------------------------------------------------------------------------
1. Change structure SEC_DSIG_SIGNATURE: Transaction SE11
Add new Component
Field Name C14N_SIGNEDINFO
Data type RAWSTRING
Activate the structure. Ignore the warning.
2. Create database table SEC_ST_REPLAY_DB: Transaction SE11
Short Description Table for replay detection
Table category Transparent table
Package SOAP_SECURITY
Delivery class L
Data class APPL1
Size category 3
Buffering not allowed
Enhancement Cannot Be Enhanced
Components
Field Name ID
Data type CHAR
Length 255
Key
Field Name TR_ID
Data type CHAR
Length 32
Field Name LOCATION
Data type CHAR
Length 1
Field Name CREATED
Data element TIMESTAMP
Field Name EXPIRES
Data element TIMESTAMP
Field Name UNAME
Data element XUBNAME
Activate the table. Ignore the warning.
3.Create / change messages WSS 019 and WSS 051: Transaction SE80
Package SOAP_SECURITY - Message class WSS
019 = 'Signature check failed - WP: &1 SSF_PAB: &2'
051 = 'XML decryption key &1 found in SEC_ST_REPLAY_DB'
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 711 SAPKB71106 - SAPKB71109 |
------------------------------------------------------------------------
1. Create database table SEC_ST_REPLAY_DB: Transaction SE11
Short Description Table for replay detection
Table category Transparent table
Package SOAP_SECURITY
Delivery class L
Data class APPL1
Size category 3
Buffering not allowed
Enhancement Cannot Be Enhanced
Components
Field Name ID
Data type CHAR
Length 255
Key
Field Name TR_ID
Data type CHAR
Length 32
Field Name LOCATION
Data type CHAR
Length 1
Field Name CREATED
Data element TIMESTAMP
Field Name EXPIRES
Data element TIMESTAMP
Field Name UNAME
Data element XUBNAME
Activate the table. Ignore the warning.
2.Create / change messages WSS 019 and WSS 051: Transaction SE80
Package SOAP_SECURITY - Message class WSS
019 = 'Signature check failed - WP: &1 SSF_PAB: &2'
051 = 'XML decryption key &1 found in SEC_ST_REPLAY_DB'
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 731 SAPKB73101 - SAPKB73103 |
------------------------------------------------------------------------
1.Create / change messages WSS 019 and WSS 051: Transaction SE80
Package SOAP_SECURITY - Message class WSS
019 = 'Signature check failed - WP: &1 SSF_PAB: &2'
051 = 'XML decryption key &1 found in SEC_ST_REPLAY_DB'
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 700 SAPKB70023 - SAPKB70026 |
------------------------------------------------------------------------
1 Create texts for report WSS_SETUP: Transaction SE38
Text symbol: 002 = WS Security Options
Selection text: C_CBC = Detect XML CBC attack
2 Create texts for report WSSE_TOKEN_CACHE_CLEANUP:
Selection text: LIFETIME = Lifetime in sec
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 702 SAPKB70205 - SAPKB70211 |
------------------------------------------------------------------------
1 Create texts for report WSS_SETUP: Transaction SE38
Selection text: C_CBC = Detect XML CBC attack
2 Create texts for report WSSE_TOKEN_CACHE_CLEANUP:
Selection text: LIFETIME = Lifetime in sec
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 710 SAPKB71011 - SAPKB71014 |
------------------------------------------------------------------------
1 Create texts for report WSS_SETUP: Transaction SE38
Text symbol: 002 = WS Security Options
Selection text: C_CBC = Detect XML CBC attack
2 Create texts for report WSSE_TOKEN_CACHE_CLEANUP:
Selection text: LIFETIME = Lifetime in sec
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 711 SAPKB71106 - SAPKB71109 |
------------------------------------------------------------------------
1 Create texts for report WSS_SETUP: Transaction SE38
Selection text: C_CBC = Detect XML CBC attack
2 Create texts for report WSSE_TOKEN_CACHE_CLEANUP:
Selection text: LIFETIME = Lifetime in sec
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 730 SAPKB73001 - SAPKB73007 |
------------------------------------------------------------------------
1 Create texts for report WSS_SETUP: Transaction SE38
Selection text: C_CBC = Detect XML CBC attack
2 Create texts for report WSSE_TOKEN_CACHE_CLEANUP:
Selection text: LIFETIME = Lifetime in sec
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 701 SAPKB70108 - SAPKB70111 |
------------------------------------------------------------------------
1 Create texts for report WSS_SETUP: Transaction SE38
Text symbol: 002 = WS Security Options
Selection text: C_CBC = Detect XML CBC attack
2 Create texts for report WSSE_TOKEN_CACHE_CLEANUP:
Selection text: LIFETIME = Lifetime in sec
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 731 SAPKB73101 - SAPKB73103 |
------------------------------------------------------------------------
1 Create texts for report WSS_SETUP: Transaction SE38
Text symbol: 002 = WS Security Options
Selection text: C_CBC = Detect XML CBC attack
2 Create texts for report WSSE_TOKEN_CACHE_CLEANUP:
Selection text: LIFETIME = Lifetime in sec
------------------------------------------------------------------------
|Manual Activity |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 701 SAPKB70108 - SAPKB70111 |
------------------------------------------------------------------------
1. Create database table SEC_ST_REPLAY_DB: Transaction SE11
Short Description Table for replay detection
Table category Transparent table
Package SOAP_SECURITY
Delivery class L
Data class APPL1
Size category 3
Buffering not allowed
Enhancement Cannot Be Enhanced
Components
Field Name ID
Data type CHAR
Length 255
Key
Field Name TR_ID
Data type CHAR
Length 32
Field Name LOCATION
Data type CHAR
Length 1
Field Name CREATED
Data element TIMESTAMP
Field Name EXPIRES
Data element TIMESTAMP
Field Name UNAME
Data element XUBNAME
Activate the table. Ignore the warning.
2.Create / change messages WSS 019 and WSS 051: Transaction SE80
Package SOAP_SECURITY - Message class WSS
019 = 'Signature check failed - WP: &1 SSF_PAB: &2'
051 = 'XML decryption key &1 found in SEC_ST_REPLAY_DB'
------------------------------------------------------------------------
|Manual Activity |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 701 SAPKB70108 - SAPKB70111 |
------------------------------------------------------------------------
------------------------------------------------------------------------
|Manual Activity |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 731 SAPKB73101 - SAPKB73103 |
------------------------------------------------------------------------
------------------------------------------------------------------------
|Manual Activity |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 730 SAPKB73001 - SAPKB73007 |
------------------------------------------------------------------------
1.Create / change messages WSS 019 and WSS 051: Transaction SE80
Package SOAP_SECURITY - Message class WSS
019 = 'Signature check failed - WP: &1 SSF_PAB: &2'
051 = 'XML decryption key &1 found in SEC_ST_REPLAY_DB'
------------------------------------------------------------------------
|Manual Activity |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 702 SAPKB70205 - SAPKB70211 |
------------------------------------------------------------------------
1.Create / change messages WSS 019 and WSS 051: Transaction SE80
Package SOAP_SECURITY - Message class WSS
019 = 'Signature check failed - WP: &1 SSF_PAB: &2'
051 = 'XML decryption key &1 found in SEC_ST_REPLAY_DB'
Ссылки
