DART Potential Directory Traversal, SAP security note 1511686

SAP security note 1511686, “DART – Potential Directory Traversal”, is a program error note released on 14.12.2010. Below are the symptom, reason and prerequisites, SAP recommended solution, CVSS score, references and the affected software components.

Description

Symptom

Potential Directory Traversal in the DART component. Vulnerabilities allow a malicious user to:

• Read arbitrary files on the remote server, potentially disclosing confidential information.
• Write arbitrary files on the remote server, possibly corrupting data or altering system behavior.

Solution

Refer to SAP Note 1497003 for additional information and instructions. Implementing the corrections from this note is a prerequisite for applying this security note.

Logical file names:

• TXW_DART_FILE_NAME_CHECK used in DART.

Logical file paths:

• TXW_DART_FILE_PATH.

Reason and prerequisites

The programs in the correction instructions contain vulnerabilities enabling directory traversal attacks.

CVSS

Score 0

References

Affected components

• SAP_APPL (31I, 40B, 45B, 46B, 46C, 470, 500, 600, 602, 603, 604, 605)