SAP security note 1133739, "Security gap in Data Browser (SE16)", is a program error note released on 03.02.2010. Below are the symptom and SAP recommended solution.
Description
Symptom
Transaction SE16 is a widely used function to display database contents in ABAP systems. It relies on authorization checks against table authorization groups using the authorization object S_TABU_DIS. However, under certain usage patterns, the system may fail to perform these authorization checks correctly. This flaw can potentially allow unauthorized access to sensitive or critical data.
Unauthorized users might exploit this vulnerability to access restricted data without proper authorizations, leading to data breaches and compliance violations.
Solution
Apply the correction provided by SAP through a Support Package or directly via correction instructions using transaction SNOTE. It’s crucial to implement this fix as soon as possible to mitigate the risk.
Risk mitigation before applying the correction:
- Restrict access to SE16: limit the number of users who have access to transaction SE16 by controlling it through the authorization object S_TCODE.
- Review user roles: ensure that only necessary roles are assigned to users, minimizing the potential exposure of sensitive data.
References
- SAP Note 1491411 – Wrong authorization handling for cluster and pool tables
- SAP Note 888889 – Automatic checks for security notes using RSECNOTE (outdated)
Full note on SAP: SAP Support Launchpad note 1133739
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].