Potential modification of persisted data, SAP security note 1456569

SAP security note 1456569 is titled "Potential modification of persisted data". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This security note has been updated. For more detailed information, see Security Note 1550925.

A malicious user can use specially crafted inputs to modify database tables, resulting in the modification of data persisted by the system.

Solution

Import the Support Package corresponding to your release or implement the correction instructions. Please note that the correction is already contained in Support Package 5 of release 7.02.

We strongly recommend that you implement this note to eliminate these security flaws. We do not assume any responsibility if you omit to implement this note and any damage occurs as a result.

The corrections do not have an influence on the normal function of the application.

After implementing the note, you can no longer use this gap. Instead, each attempt will be logged in the system log with the message: ‘IM 0 Attack from:’ and additional information.

The import of the Support Package will delete the insecure coding.

Reason and prerequisites

Affected release: SAP_BASIS 640, 700, 710, 720.

The problem is caused by an SQL injection vulnerability. The code composes an SQL statement that contains strings that can be altered by a malicious user. The manipulated SQL statement can then be used to modify information in the database.

References

Affected components

• SAP_BASIS: Versions 640, 700, 710, 720