Security problem with user parameter ‘ -TV’, SAP security note 574214

SAP security note 574214, "Security problem with user parameter '-TV'", is a note. Below are the symptom and the SAP recommended solution.

Description

Symptom

By entering the -TV user parameter using transaction SU01, SU3, or one of the BAPIs associated with the USER BOR object into a user master record, the behavior of the transaction start authorization check is altered. This change poses a security risk.

Solution

Apply a new kernel as an interim solution:

• Import the Support Package or implement the correction instructions provided in the note.
• The correction in the Support Package and the correction instructions will remove the -TV user parameter from all user master records when transactions SU01 or SU3 are next started.
• Upon saving a user master record, the -TV parameter will be deleted, preventing its re-entry.
• Note that the kernel correction, which deprecates the parameter, is not yet available for all affected releases.

Available kernel corrections:

• Basis Release 4.6x: 4.6D kernel as of patch level 1403.
• Basis Release 6.x: 6.20 kernel as of patch level 782.

This document is causing side effects in SAP Note 601472 – Authorization check with variant transactions.

References

• SAP Note 617930 – New statement LEAVE TO CURRENT TRANSACTION
• SAP Note 601472 – Authorization check with variant transactions