Directory Traversal in XX-CSC-AR, SAP security note 1603934

SAP security note 1603934, "Directory Traversal in XX-CSC-AR", is released on 08.11.2011. Below are the symptom and SAP recommended solution.

Description

Symptom

Potential Directory Traversal for report J_1A_CAE.

Solution

Refer to Note 1497003 for additional information and instructions. The corrections from Note 1497003 and Note 1533500 are prerequisites for implementing this note.

Logical File Name Used in this Solution:

• FI_J1ACAE_FILE

Program Using this Logical Filename:

• J_1A_CAE

Parameters Used:

• <PARAM_1> Program name

The application J_1A_CAE is passing an additional parameter parameter_1 (sy-cprog) to the Function Module FILE_VALIDATE_NAME. This allows customers to insert the parameter while configuring the physical paths for the Logical File Name FI_J1ACAE_FILE.

Logical File Path Used in this Solution:

• FI_AEI_FILE_PATH

Apply the correction instructions as per the note or upgrade to the indicated support package.

Reason and prerequisites

1. The programs contained in the correction instructions have vulnerabilities that allow a malicious user to potentially read arbitrary files on the remote server, possibly disclosing confidential information.

2. Some of the programs contain vulnerabilities that allow a malicious user to potentially write arbitrary files on the remote server, possibly corrupting data or altering system behavior.

Prerequisite: Note 1533500 must be implemented.

References