Directory traversal in IS-H-CM, SAP security note 1607881

SAP security note 1607881, “Directory traversal in IS-H-CM”, is a program error note released on 13.12.2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Potential directory traversal in the following components: IS-H-CM-INS and IS-H-CM-OUT.

Solution

For detailed information and instructions, refer to:

• Note 1497003 – these corrections are a prerequisite for implementing this note.
• Note 1607749 – also a prerequisite for implementing this note.

Reason and prerequisites

The programs specified in the correction instructions contain vulnerabilities through which a malicious user can potentially read arbitrary files on the remote server, possibly disclosing confidential information. Additionally, some programs allow writing arbitrary files on the remote server, which could lead to data corruption or altered system behavior.

References

• 1607749 – Directory traversal in IS-H, central program part
• 1497003 – Potential directory traversals in applications

Affected components

• IS-H (463B, 472, 600, 602, 603, 604, 605)