CANCEL registered programs, SAP security note 1465129

SAP security note 1465129, “CANCEL registered programs”, is an external error note released on 24.11.2010. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This security note has been updated. For more detailed information, see Security Note 1531820.

This affects only kernel releases 31I up to and including 46D.

• The security fix prevents a potential Denial of Service attack.
• In addition, the query as to the number of certain registered programs is subjected to a security check.

Solution

There is no workaround.

The security fix becomes active only if you implement all of the following steps:

• Apply the kernel patch that is relevant for your kernel release (see below).
• In the file sec_info, specify all programs that are permitted to DEregister programs that have been registered with the gateway, and treat this entry as if the program wants to register.
• Set the parameter gw/reg_no_conn_info as described in Note 1444282. For the fix, the value 4 is important.

By activating this patch, the system handles the query as to the number of registered servers or the request to cancel a registered program as if the program specified under “TP” wants to register.

For example: One entry P USER= * HOST= Obelix TP= DUDEL

• Allows the registration of the program DUDEL by the host Obelix on the one hand,
• But also allows the query of an external program by the host Obelix as to how often TP DUDEL is registered at the gateway and
• The CANCELing of the same program is allowed by the host Obelix.

The kernel corrections are available with the following patch level for 31I – 46D:

• 31I patch level 785
• 40B patch level 1074
• 45B patch level 1005
• 46D PL 2530

Reason and prerequisites

This is due to the gateway design.

References

• Security Note 1531820 – Update 1# to Security Note 1465129
• Note 1444282 – gw/reg_no_conn_info settings
• Note 1434117 – Bypassing sec_info without reg_info
• Note 1305851 – Overview note: "reg_info" and "sec_info"
• Note 1298433 – Bypassing security in reginfo & secinfo

Affected components

• SAP_APPL 31I to 31I+
• SAP_APPL 40B to 40B+
• SAP_APPL 45B to 45B+
• SAP_BASIS 46D