SAP Security Note
High priority
SAP security note 1491837, “ITS Applet Not Running in ITS Context”, is a program error note released on 12.10.2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The applet ws.jar (used for the frontend services in ITS) runs not in the context of the ITS but in an external page. It is still possible that the frontend service is executed.
Solution
The frontend service action is now disabled if the applet does not run in the context of the ITS. Entry “communication error with sapsystem” will be written into the Java console.
The issue described above is fixed by a SAP (integrated) ITS patch / a SAP_BASIS Support Package:
- SAP ITS 6.20: you can find the information which patch contains the respective correction in the section “SP Patch Level”.
- SAP integrated ITS (Support Packages): you can find the information which SAP_BASIS Support Package contains the respective correction in the section “Support Packages”.
To resolve the issue, please install the mentioned or a newer patch (patches are cumulative), respectively apply the listed Support Package.
If the sections “SP Patch Level” or the information about which patch/Support Package contains the correction is missing, this means that this has not been determined yet. In this case, please re-check this note at a later point in time.
Precorrection:
- SAP ITS 6.20 patch >= 33: you can find the change in the attached file ws.jar. Please exchange it with the file ws.jar in the mime directory under …\sap\its\mimes\webgui\2002\applets and …\sap\its\mimes\webgui\99\applets.
- SAP integrated ITS (Support Packages): you can find the information about the precorrection under the tab “Correction Instructions”.
Reason and prerequisites
Use of the applet on a page not created by the ITS.
References
- 1053737 – Expected Release Dates for SAP GUI for Windows
- 563161 – SAP GUI, SAP ITS, and SAP IGS Patches and Installation Media in SAP ONE Support Launchpad
- 330793 – Downloading Patches
- 97621 – OCS Info: Online Correction Support (OCS)
- 19466 – Downloading SAP Kernel Patches
Affected components
- BC-FES-ITS – Version 620
- SAP_BASIS – Versions 640, 700 to 702, 710 to 730, 72L
Full note on SAP: SAP Support Launchpad note 1491837
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].