Password history Oldest entry is not checked, SAP security note 732038

SAP security note 732038, “Password history: Oldest entry is not checked”, is a program error note released on 08.10.2009. Below are the symptom, reason and prerequisites, SAP recommended solution, CVSS score, references and the affected software components.

Description

Symptom

Contrary to the description in note 2467, the password history only contains 4 instead of 5 entries. This means that the user can reuse an old password after having chosen 4 (instead of 5) user-defined passwords.

Solution

Import a new kernel:

• For Basis Release 4.6x: import kernel 4.6D as of patch number 1825.
• For Basis Release 6.10/6.20: import kernel 6.20 as of patch number 1461.
• For Basis Release 6.40: import kernel 6.40 as of patch number 15.

Reason and prerequisites

This is an error in the kernel: the system does not check the last (that is, oldest) entry.

CVSS

Score 0

References

Affected components

• SAP_BASIS (46A to 46D)
• SAP_BASIS (610 to 640)