SAP Security Note
High priority
SAP security note 1488739, "CML: Possible directory traversal", is a program error note released on 14.12.2010. Below are the symptom and the SAP recommended solution.
Description
Symptom
An error in FS-CML-AC-RPM-IAS (creation of test files for payment processing) allows any data to be read and written using the network.
Solution
Implement the attached advance corrections or import the relevant Support Package.
Reason and prerequisites
The payment processing contains an error when checking paths to which data transferred by a user is written. An attacker can use this to transfer any data to the remote system or to overwrite existing data.
References
Full note on SAP: SAP Support Launchpad note 1488739
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].