Generic ABAP function calls, SAP security note 1411701

SAP security note 1411701, "Generic ABAP function calls", is a program error note released on April 23, 2012. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

ABAP functions to be executed are determined at runtime based on input. Specifically, the function name to be executed at runtime can be passed as an input parameter.

Solution

Ensure that dynamically called functions are not determined by user input. Code changes have been implemented so that the functions passed as input are not executed. Apply the correction instructions in this note using transaction /nsnote.

Reason and prerequisites

ABAP functions executed at runtime based on input may lead to the following issues:

• Crash of the SAP application server
• Disruption of business logic, resulting in inconsistent data states
• Manipulation of business logic, resulting in unprivileged access to restricted functionality

References

• 1028938 – Workflow: Composite note
• 888889 – Automatic checks for security notes using RSECNOTE (outdated)

Affected components

• SAP_BASIS: 6.40 to 6.40
• SAP_BASIS: 7.00 to 7.02
• SAP_BASIS: 7.10 to 7.20