Directory traversal in FI-FM, SAP security note 1599164

SAP security note 1599164, "Directory Traversal in FI-FM", is a program error note released on August 9, 2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This security note addresses potential directory traversal vulnerabilities in the FI-FM component of SAP Financial Accounting. Specifically, the vulnerabilities allow a malicious user to:

• Read arbitrary files: potentially disclose confidential information by reading arbitrary files on the remote server.
• Write arbitrary files: potentially corrupt data or alter system behavior by writing arbitrary files on the remote server.

Solution

• Apply prerequisite corrections: ensure that all corrections from Note 1497003 are implemented.
• Validate file names and paths:
  • Logical file name FM_RFFMMDBI_FILE, used by programs RFFMMDBI81 and RFFMMDBI85
  • Logical file path FM_RFFMMDBI_PATH

For detailed instructions, refer to the correction instructions provided in this note.

Reason and prerequisites

The vulnerabilities exist in the programs specified in the correction instructions. To implement the corrections from this note, it is required to first apply Note 1497003, which provides additional information and prerequisite corrections.

References

• 1497003 – Potential directory traversals in applications

Affected components

• SAP_APPL 470, 500, 600, 602, 603, 604, 605