Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1768943-3)
SAP Support Packages
(SAPK-470E0INSAPHRCIT, SAPK-470E1INSAPHRCIT, SAPK-470E2INSAPHRCIT, SAPK-500A6INSAPHRCIT, SAPK-500A7INSAPHRCIT, SAPK-500A8INSAPHRCIT, SAPK-60089INSAPHRCIT, SAPK-60090INSAPHRCIT, SAPK-60091INSAPHRCIT, SAPK-60455INSAPHRCIT, SAPK-60456INSAPHRCIT, SAPK-60457INSAPHRCIT, SAPKE46CJ5, SAPKE46CJ6, SAPKE46CJ7)
Описание
PY-IT fails to correctly validate the path to which a user-submitted file is written. As a result, an attacker can potentially overwrite data in the remote system.
Как исправить
Due to solve the issue reported please use Note Assistant (SNOTE) to implement the correction instructions.In order to create the logical file please see the manual instruction steps.------------------------------------------------------------------------|Manual Activity |------------------------------------------------------------------------|VALID FOR ||Software Component SAP_HR R/3 Standard Hu...|| Release 46C Until SAPKE46CJ4 |------------------------------------------------------------------------
Execute transaction FILE.
In the tree on the left-hand side, double-click "Logical File Path Definition".
Choose "New Entries".
Create the following entries as logical file paths (in upper case) with the following names:
HR_IT_DEFAULT_PATH Default path
Save your entries.
In the tree on the left-hand side, double-click "Logical File Name Definition, Cross-Client".
Choose "New Entries" and enter the following new entries (choose F8 to enter the next new entry):
Logical file HR_IT_DIR_RPCLULI0 Name Single Book Physical file Data format DIR Applicat.area HR Logical path HR_IT_DEFAULT_PATH Logical file HR_IT_DIR_RPUESBI0 Name Mark Uniemens file as sent / Save on server Physical file Data format DIR Applicat.area HR Logical path HR_IT_DEFAULT_PATH
Save your entries.
Use the option "Assignment of Physical Paths to Logical Path" in transaction FILE to make the required assignment of a physical path for each of the customer-specific syntax groups for each logical path. You can use transaction SF01 to maintain client-specific logical file names. For further information about this topic, refer to the documentation in the Implementation Guide (IMG) under the path "SAP NetWeaver -> Application Server -> System administration -> Platform-Independent File Names".------------------------------------------------------------------------|Manual Activity |------------------------------------------------------------------------|VALID FOR ||Software Component SAP_HRCIT || Release 470 Until SAPK-470D9INSAPHRCIT || Release 500 Until SAPK-500A5INSAPHRCIT || Release 600 Until SAPK-60088INSAPHRCIT || Release 604 Until SAPK-60454INSAPHRCIT |------------------------------------------------------------------------
Execute transaction FILE.
In the tree on the left-hand side, double-click "Logical File Path Definition".
Choose "New Entries".
Create the following entries as logical file paths (in upper case) with the following names:
HR_IT_DEFAULT_PATH Default path
Save your entries.
In the tree on the left-hand side, double-click "Logical File Name Definition, Cross-Client".
Choose "New Entries" and enter the following new entries (choose F8 to enter the next new entry):
Logical file HR_IT_DIR_RPCLULI0 Name Single Book Physical file Data format DIR Applicat.area HR Logical path HR_IT_DEFAULT_PATH Logical file HR_IT_DIR_RPUESBI0 Name Mark Uniemens file as sent / Save on server Physical file Data format DIR Applicat.area HR Logical path HR_IT_DEFAULT_PATH
Save your entries.
Use the option "Assignment of Physical Paths to Logical Path" in transaction FILE to make the required assignment of a physical path for each of the customer-specific syntax groups for each logical path. You can use transaction SF01 to maintain client-specific logical file names. For further information about this topic, refer to the documentation in the Implementation Guide (IMG) under the path "SAP NetWeaver -> Application Server -> System administration -> Platform-Independent File Names".
Execute transaction FILE.
In the tree on the left-hand side, double-click "Logical File Path Definition".
Choose "New Entries".
Create the following entries as logical file paths (in upper case) with the following names:
HR_IT_DEFAULT_PATH Default path
Save your entries.
In the tree on the left-hand side, double-click "Logical File Name Definition, Cross-Client".
Choose "New Entries" and enter the following new entries (choose F8 to enter the next new entry):
Logical file HR_IT_DIR_RPCLULI0 Name Single Book Physical file Data format DIR Applicat.area HR Logical path HR_IT_DEFAULT_PATH Logical file HR_IT_DIR_RPUESBI0 Name Mark Uniemens file as sent / Save on server Physical file Data format DIR Applicat.area HR Logical path HR_IT_DEFAULT_PATH
Save your entries.
Use the option "Assignment of Physical Paths to Logical Path" in transaction FILE to make the required assignment of a physical path for each of the customer-specific syntax groups for each logical path. You can use transaction SF01 to maintain client-specific logical file names. For further information about this topic, refer to the documentation in the Implementation Guide (IMG) under the path "SAP NetWeaver -> Application Server -> System administration -> Platform-Independent File Names".------------------------------------------------------------------------|Manual Activity |------------------------------------------------------------------------|VALID FOR ||Software Component SAP_HRCIT || Release 470 Until SAPK-470D9INSAPHRCIT || Release 500 Until SAPK-500A5INSAPHRCIT || Release 600 Until SAPK-60088INSAPHRCIT || Release 604 Until SAPK-60454INSAPHRCIT |------------------------------------------------------------------------
Execute transaction FILE.
In the tree on the left-hand side, double-click "Logical File Path Definition".
Choose "New Entries".
Create the following entries as logical file paths (in upper case) with the following names:
HR_IT_DEFAULT_PATH Default path
Save your entries.
In the tree on the left-hand side, double-click "Logical File Name Definition, Cross-Client".
Choose "New Entries" and enter the following new entries (choose F8 to enter the next new entry):
Logical file HR_IT_DIR_RPCLULI0 Name Single Book Physical file Data format DIR Applicat.area HR Logical path HR_IT_DEFAULT_PATH Logical file HR_IT_DIR_RPUESBI0 Name Mark Uniemens file as sent / Save on server Physical file Data format DIR Applicat.area HR Logical path HR_IT_DEFAULT_PATH
Save your entries.
Use the option "Assignment of Physical Paths to Logical Path" in transaction FILE to make the required assignment of a physical path for each of the customer-specific syntax groups for each logical path. You can use transaction SF01 to maintain client-specific logical file names. For further information about this topic, refer to the documentation in the Implementation Guide (IMG) under the path "SAP NetWeaver -> Application Server -> System administration -> Platform-Independent File Names".
Ссылки
