Directory Traversal in batch input reports in class system, SAP security note 1499042

SAP Note 1499042SAP Security NoteHigh priority

SAP security note 1499042, “Directory Traversal in batch input reports in class system”, is a program error note released on 14.12.2010. Below is the security information published by SAP for this note.

ComponentCA-CL (Cross-Application Components > Classification)

CategoryProgram error

PriorityCorrection with high priority

TypeSAP Security Note

Version3

StatusReleased for Customer

Released on14.12.2010

LanguageEnglish

Description

Symptom

The batch input reports in classification contain a vulnerability through which a malicious user can potentially write arbitrary files on the remote server, possibly corrupting data or altering system behavior.

Reason and prerequisites

The reports RCCTBI01, RCCTBISC, RCCLDI01, RCCLBI01, RCCLBI02, RCCLBI03, RCCLBISC, and RCCLBISH fail to correctly validate the path a user-submitted file is written to. This means that an attacker can potentially overwrite data on the remote system.

Solution

Implement the changes in accordance with the advance correction.

Affected components

SAP_ABA from version 702 to 702
SAP_ABA from version 730 to 730

Full note on SAP: SAP Support Launchpad note 1499042

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Classification)