SAP security note 614971, "GW: Changes to the ACL list of the gateway (secinfo)". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
In the secinfo file, external programs that can be started or registered on the gateway are defined. Up to Kernel Release 46D, this was managed within the secinfo file. However, starting from Release 6.40, the registration of external server programs is controlled using a separate reginfo file.
secinfo defines which external programs may be started. reginfo controls the registration of external server programs.
If the reginfo file does not exist, the system starts all external programs. If the reginfo file exists but is empty or contains invalid lines, no external programs can be started. To start an external program, a valid entry must exist in the reginfo file. Otherwise, the system will reject the request with an authorization error.
Solution
- Entry Syntax: Each line in the reginfo file must include USER, HOST, and TP (program ID).
- Wildcards: Allowed for dynamic program IDs (e.g., TP=XYZ*).
- Case Sensitivity: Keywords must be in uppercase (e.g., HOST is correct; host is incorrect).
- Host and User Specifications: Detailed guidelines on specifying hostnames, IP addresses, and user names for enhanced security.
Ensure all entries in the reginfo file adhere to the required syntax and include all necessary keywords in uppercase. Refer to Note 1298433 for details on how lines without USER-HOST are treated in relevant patch levels.
References
- Note 1503858 – Colored lines for sec(-reg) info test in SMGW
- Note 1473017 – Uppercase/lowercase in the files reg_info and sec_info
- Note 1425765 – Generating sec_info reg_info
- Note 1408081 – Basic settings for reg_info and sec_info
- Note 1298433 – Bypassing security in reginfo & secinfo
- Note 750877 – Prefix for program ID for start using BACK destination
- Note 618516 – Security-related enhancement of RFCEXEC program
Affected components
- SAP_BASIS 46B to 46D+
- SAP_BASIS 620 to 640+
Full note on SAP: SAP Support Launchpad note 614971
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
