LO-MD-MM Potential Directory Traversal, SAP security note 1500050

SAP security note 1500050, "LO-MD-MM: Potential Directory Traversal". Below are the symptom and SAP recommended solution.

Description

Symptom

Potential directory traversal in the following component: LO-MD-MM.

Solution

Implement the attached corrections. Please refer to Note 1497003 for additional information and instructions. The corrections from Note 1497003 are a prerequisite for the implementation of this note.

Logical file names used in this solution:

• MATERIAL_MASTER_BTCI_NEW
• MATERIAL_MASTER_BTCI_LOG

Programs using these logical file names:

• RMDATIND
• RMDATSHO
• RMDATGEN
• MVER_DI

All logical file names listed above use the logical file path LO_MD_ROOT.

Recommendations for setup of logical file names: please refer to Note 1498832 for additional information regarding the setup of logical file names in the context of file name validation.

Reason and prerequisites

The programs contained in the correction instructions have vulnerabilities that allow a malicious user to potentially read arbitrary files on the remote server, possibly disclosing confidential information.

Some programs contain vulnerabilities that allow a malicious user to potentially write arbitrary files on the remote server, possibly corrupting data or altering system behavior.

References

• 1497003 – Potential directory traversals in applications
• 1774270 – Update 1 to security note 1500050
• 693052 – RMDATIND: Termination with conversion error
• 1008640 – RMDATIND: Conversion error for different code page