SAP security note 1469982, "Code injection vulnerability in ECC and SAP R/3", released on 14.09.2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
SAP R/3 4.6, Enterprise R/3 4.7, ECC 5.00, ECC 6.00 – 6.04 contain code which allows the execution of arbitrary program code of the user’s choice. A malicious user can therefore control the behavior of the system or potentially escalate privileges by executing malicious code without legitimate credentials.
Solution
Apply the attached correction instructions or implement the HR support packages in which the corrections have been included.
Reason and prerequisites
The program code contains a possibility to define and execute code of the user’s choice, which changes the system’s behavior. A valid and authenticated user with authorization for transaction SA38 or SE38 is required. Although the vulnerability is caused by code belonging to SAP_HR, the injection is not restricted to this component as the injected code can affect any other component of the system.
References
- Automatic checks for security notes using RSECNOTE (outdated)
- Announcement: New HCM Legal Change Delivery Process
Affected components
- SAP_HR 46C
- SAP_HR 470
- SAP_HR 500
- SAP_HR 600
- SAP_HRCIT 470
- SAP_HRCIT 500
- SAP_HRCIT 600
- SAP_HRCIT 604
Full note on SAP: SAP Support Launchpad note 1469982
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
