Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
(AV:N/AC:H/AU:S/C:C/I:C/A:C)
Производитель ПО
Наименование ПО
SAP Notes
(1692988-11)
SAP Support Packages
(SAPKB46B62, SAPKB46C64, SAPKB46C65, SAPKB62072, SAPKB62073, SAPKB64030, SAPKB64031, SAPKB70027, SAPKB70028, SAPKB70112, SAPKB70113, SAPKB70212, SAPKB70213, SAPKB71015, SAPKB71016, SAPKB71110, SAPKB71111, SAPKB72008, SAPKB73008, SAPKB73009, SAPKB73104, SAPKB73105, SAPKH45B67)
Описание
BC-SRV-COM-FTP fails to correctly validate the path a user-submitted file is written to. Through this, an attacker can potentially overwrite data on the remote system.
Please implement the note 1605054 before implementing this note
Please implement the note 1605054 before implementing this note
Как исправить
Please implement the correction instructions attached to this snote(manual and automatic).
In order to do a directory traversal check, the Logical path name against which the physical path should be validated has to be provided by the applications using SAPFTP.
Please refer to the note 1686247 to enable the security audit logs.
Please refer to the note 1497003 for the logical path configuration.
In order for the applications to be able to set the logical path, the following class/function module has been created
1. For releases >= 620
A singleton class is created by name FTP_LOGICAL_PATH_CHECK.
The applications have to use the method FTP_SET_LOGICAL_PATH to set the logical path name.
2. For releases < 620
The applications have to use the function module FTP_SET_LOGICAL_PATH function to set the logical path name.
Once you have implemented this note, please implement the note 1754531 for the functionality to work.
------------------------------------------------------------------------
|Manual Activity |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_APPL SAP Application |
| Release 45B Until SAPKH45B66 |
------------------------------------------------------------------------
Please create the Function Module FTP_SET_LOGICAL_PATH as follows:
1.Goto package SFTP in se80.
2.Right Click on Function Module->Create
3.Enter the function name as FTP_SET_LOGICAL_PATH.
4.In the Import tab enter the parameter name as LPATH and the corresponding parameter type as FILENAME-FILEINTERN.
5.In the Export tab enter the parameter name as S_LOGICAL_FILE_PATH and the corresponding parameter type as FILENAME-FILEINTERN.
Please create the Function Module FTP_GET_LOGICAL_PATH as follows:
1.Goto package SFTP in se80.
2.Right Click on Function Module->Create
3.Enter the function name as FTP_GET_LOGICAL_PATH.
4.In the Export tab enter the parameter name as LPTH and the corresponding parameter type as FILENAME-FILEINTERN.
------------------------------------------------------------------------
|Manual Activity |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 46C Until SAPKB46C63 |
| Release 46B Until SAPKB46B61 |
------------------------------------------------------------------------
Please create the Function Module FTP_SET_LOGICAL_PATH as follows:
1.Goto package SFTP in se80.
2.Right Click on Function Module->Create
3.Enter the function name as FTP_SET_LOGICAL_PATH.
4.In the Import tab enter the parameter name as LPATH and the corresponding parameter type as FILENAME-FILEINTERN.
5.In the Export tab enter the parameter name as S_LOGICAL_FILE_PATH and the corresponding parameter type as FILENAME-FILEINTERN.
Please create the Function Module FTP_GET_LOGICAL_PATH as follows:
1.Goto package SFTP in se80.
2.Right Click on Function Module->Create
3.Enter the function name as FTP_GET_LOGICAL_PATH.
4.In the Export tab enter the parameter name as LPTH and the corresponding parameter type as FILENAME-FILEINTERN.
In order to do a directory traversal check, the Logical path name against which the physical path should be validated has to be provided by the applications using SAPFTP.
Please refer to the note 1686247 to enable the security audit logs.
Please refer to the note 1497003 for the logical path configuration.
In order for the applications to be able to set the logical path, the following class/function module has been created
1. For releases >= 620
A singleton class is created by name FTP_LOGICAL_PATH_CHECK.
The applications have to use the method FTP_SET_LOGICAL_PATH to set the logical path name.
2. For releases < 620
The applications have to use the function module FTP_SET_LOGICAL_PATH function to set the logical path name.
Once you have implemented this note, please implement the note 1754531 for the functionality to work.
------------------------------------------------------------------------
|Manual Activity |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_APPL SAP Application |
| Release 45B Until SAPKH45B66 |
------------------------------------------------------------------------
Please create the Function Module FTP_SET_LOGICAL_PATH as follows:
1.Goto package SFTP in se80.
2.Right Click on Function Module->Create
3.Enter the function name as FTP_SET_LOGICAL_PATH.
4.In the Import tab enter the parameter name as LPATH and the corresponding parameter type as FILENAME-FILEINTERN.
5.In the Export tab enter the parameter name as S_LOGICAL_FILE_PATH and the corresponding parameter type as FILENAME-FILEINTERN.
Please create the Function Module FTP_GET_LOGICAL_PATH as follows:
1.Goto package SFTP in se80.
2.Right Click on Function Module->Create
3.Enter the function name as FTP_GET_LOGICAL_PATH.
4.In the Export tab enter the parameter name as LPTH and the corresponding parameter type as FILENAME-FILEINTERN.
------------------------------------------------------------------------
|Manual Activity |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 46C Until SAPKB46C63 |
| Release 46B Until SAPKB46B61 |
------------------------------------------------------------------------
Please create the Function Module FTP_SET_LOGICAL_PATH as follows:
1.Goto package SFTP in se80.
2.Right Click on Function Module->Create
3.Enter the function name as FTP_SET_LOGICAL_PATH.
4.In the Import tab enter the parameter name as LPATH and the corresponding parameter type as FILENAME-FILEINTERN.
5.In the Export tab enter the parameter name as S_LOGICAL_FILE_PATH and the corresponding parameter type as FILENAME-FILEINTERN.
Please create the Function Module FTP_GET_LOGICAL_PATH as follows:
1.Goto package SFTP in se80.
2.Right Click on Function Module->Create
3.Enter the function name as FTP_GET_LOGICAL_PATH.
4.In the Export tab enter the parameter name as LPTH and the corresponding parameter type as FILENAME-FILEINTERN.
Ссылки
