High priority
SAP security note 1488159, "SUIM RSUSR003 incorrect results for CODVN = ‘F’", is released on May 23, 2011. Below are the symptom and SAP recommended solution.
Description
Symptom
The report RSUSR003 displays incorrect password status for users whose passwords are stored in code version ‘F’.
Solution
Apply the correction instructions via SNOTE or import the relevant Support Package as listed below. This resolves the inaccurate password status evaluation in RSUSR003.
Reason and prerequisites
A program error affects systems with Basis releases 7.00 and 7.01. In these releases, entries with code version ‘F’ are generated only if the profile parameter login/password_downwards_compatibility is set to 0.
References
Full note on SAP: SAP Support Launchpad note 1488159
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].