Directory traversal in data interface to SAP F&R, SAP security note 1592399

SAP security note 1592399, “Directory traversal in data interface to SAP F&R”, is a program error note released on 08.11.2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Potential directory traversal in the data interface to SAP F&R.

Solution

The correction involves validating the logical file name to determine the physical file name. This ensures that only authorized file operations are permitted, eliminating the directory traversal vulnerability. These corrections are independent of Note 1497003.

Reason and prerequisites

The program specified in the correction instructions contains a vulnerability that enables a malicious user to write arbitrary files on the remote server. This could lead to data corruption or changes in system behavior.

References

• 876576 – Corrections for structured articles in purchase order interface

Affected components

• SAP_APPL: Versions 600, 602, 603, 604, 605
• PI: From version 2004_1_46C to 2004_1_500