Protect read access to password hash value tables, SAP security note 1484692

SAP security note 1484692, "Protect read access to password hash value tables", released on December 2, 2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Insufficient authority checks may permit read access to tables that store password hash values. This vulnerability can be leveraged to perform password hash attacks, compromising the security of user credentials.

Solution

To mitigate this vulnerability, you can either install the assigned support package or implement the correction manually by following these steps:

1. Create a new authorization group (transaction SE54)

• Call transaction SE54.
• Set the radio button to "Authorization Groups".
• Press the "Create/Change" button.
• Create a new entry with Authorization Group (AuGr) SPWD and description "Password Hash Values".
• Save the new record (a transport request is required).

2. Assign authorization groups to relevant tables (transaction SE11)

• Call transaction SE11 and display table USH02.
• Navigate via the menu Utilities -> Assign Authorization Group.
• Change the existing value in the "Authorization" column to SPWD. If there is no entry, create one to assign the authority group SPWD to the table.
• Save the changes. If the message "Choose the key from the allowed namespace" appears, press Enter to continue.
• Repeat this step for all relevant tables listed below.

Tables/views affected: USH02 (all releases), USH02_ARC_TMP (release 6.20 and later), USR02 (all releases), USRPWDHISTORY (release 7.00 and later), VUSER001 (release 4.5B and later), VUSR02_PWD (release 7.10 and later).

3. Verify your authorization concept

Ensure that no user has generic access to tables with the authorization group SPWD.

• Start the report RSUSR002.
• Enter authorization object S_TABU_DIS in the "Selection by values" frame.
• Add the value SPWD in the search field for the authorization group.
• Run the report to check for unauthorized access.
• Use SUIM reports to identify and adjust responsible roles or profiles as necessary.

References

Affected components

• BC-SEC-LGN (Authentication) and related components