Missing authorization check in transaction SUB%, SAP security note 842915

SAP security note 842915, "Missing authorization check in transaction SUB%", is a program error note released on 08.10.2009. Below are the symptom and SAP recommended solution.

Description

Symptom

Any transactions can be started from transaction SUB% without the relevant transaction start authorization for each transaction being checked against S_TCODE.

Reports can also be started with transaction SUB%. However, an authorization check is always performed against S_PROGRAM for these reports, provided that the report in question is assigned to an authorization group.

Solution

Implement the corrections attached to this note or import the specified Support Packages.

Reason and prerequisites

For technical reasons, transaction SUB% is required by certain functions of ABAP-based SAP systems (including SAP shortcuts) to start reports or transactions. However, transaction SUB% can also be started by users directly if their authorization (authorization object S_TCODE) permits this.

Due to a program error, there is no check in transaction SUB% to determine whether the user has the authorizations required to execute the transactions to be started.