Code injection vulnerability in ECC and SAP R/3, SAP security note 1453655

SAP security note 1453655, "Code injection vulnerability in ECC and SAP R/3", is a program error note released on August 10, 2010. Below are the symptom and SAP recommended solution.

Description

Symptom

SAP R/3 4.6, Enterprise R/3 4.7, ECC 5.00, ECC 6.00 – 6.04 contain code that allows uncommenting any commented ABAP program code. This change enables a malicious user to alter system behavior or potentially escalate privileges by executing previously deactivated code without legitimate own credentials.

Solution

Apply the attached correction instructions or implement the HR support packages in which the corrections have been included.

Reason and prerequisites

The vulnerability exists because the program code allows uncommenting commented ABAP code by removing the ‘*’ character at the beginning of a code line or commenting code by inserting ‘*’ at the first position. A valid and authenticated user with authorization for transaction SA38 or SE38 is required. Although the vulnerability is caused by code belonging to SAP_HRCDK, it is not restricted to this component and can affect any component of the system.

CVSS

Score 0

References

• 1167891 – Announcement: New HCM Legal Change Delivery Process
• 888889 – Automatic checks for security notes using RSECNOTE (outdated)