SAP Security Note
High priority
SAP security note 1493809, "Code injection vulnerability in UAC_ASSIGNMENT_CONTROL_TEST", released on May 11, 2011. Below are the symptom and SAP recommended solution.
Description
Symptom
This security note has been updated. For more detailed information, see Security Note 1572613.
The program UAC_ASSIGNMENT_CONTROL_TEST contains code that allows the execution of arbitrary program code of the user’s choice. A malicious user can control the system’s behavior or potentially escalate privileges by executing malicious code without legitimate credentials.
Solution
A correction has been made in the corresponding support package. For an urgent correction, please apply the attached correction instructions.
Reason and prerequisites
The program code allows defining and executing user-supplied code that changes the system’s behavior. This requires a valid and authenticated user. Depending on the injected code, the user can:
- Inject and run their own code
- Obtain additional information not intended for display
- Modify or delete data
- Alter system output
- Create new users with higher privileges
- Perform a denial of service (DoS) attack
References
Full note on SAP: SAP Support Launchpad note 1493809
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
