FI-Potential Directory Traversal J_1AF016, SAP security note 1596487

SAP security note 1596487, “FI-Potential Directory Traversal: J_1AF016”, is a program error note released on September 12, 2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

FI-Potential Directory Traversal: J_1AF016.

Solution

Refer to Note 1497003 for additional information and instructions. The corrections from this note are a prerequisite for implementing this note.

• Logical filename: FI_J1AF016_FILE
• Program using this filename: J_1AF016
• Logical file path: FI_J1AF_FILE_PATH

Reason and prerequisites

1. Read arbitrary files: the programs included in the correction instructions contain vulnerabilities that allow a malicious user to potentially read arbitrary files on the remote server, which may disclose confidential information.

2. Write arbitrary files: some programs also allow a malicious user to potentially write arbitrary files on the remote server, possibly corrupting data or altering system behavior.

References

Affected components

• SAP_APPL (Versions 46C, 470, 500, 600, 602, 603, 604, 605)