Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1786809-3)
SAP Support Packages
(SAPK-470E0INSAPHRCNO, SAPK-500A6INSAPHRCNO, SAPK-60089INSAPHRCNO, SAPK-60455INSAPHRCNO)
Описание
PY-NO fails to correctly validate the path that is used to reference a file that is read from the remote server. As a result, an attacker can potentially direct the program to an arbitrary file in the system, disclosing its contents.PY-NO fails to correctly validate the path to which a user-submitted file is written. As a result, an attacker can potentially overwrite data in the remote system.
Как исправить
Please refer to note 1497003 for additional information and instructions. The corrections from note 1497003 are a prerequisite for the implementation of this note.Logical file names used in this solutionThe following logical file names have been created to enable the validation of physical file names:HR_NO_DIR_DOWNLOADHR_NO_DIR_UPLOADRecommendations for setting up logical file namesAvoid maintaining a high number of logical file names as programs share the same logical file name.Using the same logical file name for various programs creates dependencies among these programs. To securely separate data created by different users and different programs, try to create a directory structure that reflects the user name and/or program name, and use this information when setting up the physical path and file names for the logical file paths and file names.------------------------------------------------------------------------|Manual Post-Implement. |------------------------------------------------------------------------|VALID FOR ||Software Component SAP_HRCNO || Release 470 SAPK-470C3INSAPHRCNO - SAPK-470D9INSAPHRCNO || Release 500 SAPK-50089INSAPHRCNO - SAPK-500A5INSAPHRCNO || Release 600 SAPK-60072INSAPHRCNO - SAPK-60088INSAPHRCNO || Release 604 SAPK-60438INSAPHRCNO - SAPK-60454INSAPHRCNO |------------------------------------------------------------------------Create Logical File Path Definition 'HR_NO_DIR_DOWNLOAD' via IMG activity"Cross-Client Maintenance of File Names and Paths" (SAP NetWeaver -> Application Server -> System administration -> Platform-Independent File Names) or via transaction FILE.Insert new entry 'HR_NO_DIR_DOWNLOAD' (Global download directory for Norway) in node "Logical File Path Definition"SaveWhile new entry is marked double-click on "Assignment of Physical Paths to Logical Path"Maintain entries according to your operating system and the path to useCreate Logical File Name Definition'HR_NO_DIR_DOWNLOAD' via IMG activity "Cross-Client Maintenance of File Names and Paths" (SAP NetWeaver -> Application Server -> System administration -> Platform-Independent File Names) or via transaction FILE.Insert new entry 'HR_NO_DIR_DOWNLOAD' in node "Logical File Name Definition, Cross-Client"Maintain following values:Logical file: HR_NO_DIR_DOWNLOADName: Global download directory for NorwayData format: DIRApplicat.area: HRLogical path: HR_NO_DIR_DOWNLOADRepeat the same (create second pair) for - Logical File Path Definition 'HR_NO_DIR_UPLOAD' - Global upload directory for Norway- Logical File Name Definition 'HR_NO_DIR_UPLOAD' - Global upload directory for Norway
Ссылки
