SU01 SAP GUI input history saves passwords, SAP security note 1365205

SAP security note 1365205, "SU01: SAP GUI input history saves passwords", is released on 09.06.2010. Below are the symptom and SAP recommended solution.

Description

Symptom

When using transaction SU01 to create a new initial password for a user, the password is displayed as plaintext in the password field. Pressing "Enter" in the password field results in the system saving the password in the input history of SAP GUI, posing a security risk.

There is a need to enter or generate downward-compatible passwords for service users and system users without altering the general password rules (e.g., the system parameter login/password_downwards_compatibility).

Solution

Use the SAP Note Assistant to implement the correction instructions or import the relevant Support Package. If using transaction SNOTE to apply the corrections, perform the following manual activities:

• Add Field to Structure: Use transaction SE11 to modify the structure SUID_ST_NODE_PASSWORD_EXT by adding the field DOWNWARD_COMP (data element CHAR1).
• Update Program Texts: Use transaction SE80 to modify the report texts in the program SAPLSUID_MAINTENANCE by adding the text elements Sym 065 ("Old password rules (No differentiation between upper- and lowercase)") and Sym 066 ("New password rules (Differentiation between upper- and lowercase)").

For Basis Release 7.11 or lower, implement Notes 1410831 and 1384632.

Reason and prerequisites

This issue is caused by a program error.

References

• 1410831 – Transaction SU01: Generating downward-compatible passwords
• 1384632 – SU01: SAP GUI input history saves passwords
• 1529805 – SU01: Additional authorization check when setting password