SAP security note 1510342, "Code injection vulnerability in package STU2", is a program error note released on 14.12.2010. Below are the symptom and SAP recommended solution.
Description
Symptom
Package STU2 contains code which allows execution of arbitrary program code of the user's choice. A malicious user can control system behavior or potentially escalate privileges by executing malicious code without legitimate credentials.
Solution
Import one of the following Support Packages:
- SAP Basis 7.00 Support Package 23
- SAP Basis 7.01 Support Package 8
- SAP Basis 7.02 Support Package 6
- SAP Basis 7.10 Support Package 12
- SAP Basis 7.11 Support Package 6
- SAP Basis 7.30 Support Package 2
Reason and prerequisites
The program code allows defining and executing user-supplied code, altering system behavior. A valid and authenticated user is required, along with one or more authorizations for Authorization object S_DB2_ADM. Depending on the code, the user can inject and run their own code, access additional information, modify or delete data, alter system output, create new users with higher privileges, or perform denial of service attacks.
Full note on SAP: SAP Support Launchpad note 1510342
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].