SAP Security Note
Medium priority
SAP security note 1504205, "CM: Potential Directory Traversal ICL_VEHCATALOG", is a program error note released on 14.12.2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Potential Directory Traversal in the program ICL_VEHCATALOG_UPLOAD.
Solution
Please refer to Note 1497003 for additional information and instructions. The corrections from Note 1497003 are a prerequisite for implementation of this note.
The logical file name ICLVEH is used in this solution, and all logical file names use the logical file path ICLVEH.
Reason and prerequisites
The programs contained in the correction instructions contain vulnerabilities through which a malicious user can potentially read arbitrary files on the remote server, possibly disclosing confidential information. Some of the programs contained in the correction instructions contain a vulnerability through which a malicious user can potentially write arbitrary files on the remote server, possibly corrupting data or altering system behavior.
References
This note refers to
Affected components
- INSURANCE: Versions 471, 472, 600, 602, 603, 604, 605
Full note on SAP: SAP Support Launchpad note 1504205
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].