SAP Security Note
High priority
SAP security note 1419261, "Error during Credit card Encryption not propagated in TR BP.", is a program error note released on 21.05.2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
When the customer has set up External encryption and an error occurs for some reason, the error is not propagated. Instead, the system suppresses the error and performs internal encryption in SAP GUI. This leads customers to believe that External encryption was successful, even though an error has occurred. This scenario occurs in transaction BP when creating payment card data.
Solution
Apply the source code changes provided in the security note to resolve the error.
Reason and prerequisites
This issue is due to a program error. According to standards, whenever an error occurs during External encryption, the error should be notified to the end user.
References
- SAP Note 888889 – Automatic checks for security notes using RSECNOTE (outdated)
Affected components
- SAP_ABA: 620 to 620
- SAP_ABA: 640 to 640
- SAP_ABA: 700 to 702
- SAP_ABA: 710 to 720
Full note on SAP: SAP Support Launchpad note 1419261
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
