Security updates for Live Auction Cockpit, SAP security note 1506858

SAP security note 1506858, “Security updates for Live Auction Cockpit”, is a program error note released on 14.12.2010. Below are the symptom, the SAP recommended solution and the affected software components.

Description

Symptom

SAP Security Note 1506858 addresses critical security updates for the Live Auction Cockpit within the Supplier Relationship Management (SRM) component of SAP. This note resolves a Cross Site Request Forgery (XSRF) vulnerability and issues related to the re-login requirement when HTTPOnly cookie settings are enabled.

Solution

To mitigate the identified vulnerabilities, follow these steps:

• Apply Correction Instructions: Access the Correction Instructions and follow the provided guidelines to implement the necessary fixes.
• Update Live Auction Web Presentation Server (LACWPS): If you’re using LACWPS on JAVA, download and install the latest patch from the SAP Service Marketplace corresponding to your LACWPS release version.

References

• Note 1658516: Applets fail due to XSRF protection (COOKIE_NOT_FOUND)
• Note 1532777: Collective Note: ABAP Session Protection Recommendations
• Note 1420203: Enable foreign access to a stateful HTTP session
• Note 943336: HttpOnly cookie attribute

Affected components

• SRM_SERVER 500
• SRM_SERVER 550
• SRM_SERVER 600
• SRM_SERVER 700
• SRM_SERVER 701