Attacker could get administrative access to the database, SAP security note 1577354

SAP security note 1577354, "Attacker could get administrative access to the database", is released on 12.07.2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A critical SQL injection vulnerability has been identified in the SAP database monitor for Microsoft SQL Server. Malicious users can exploit transactions such as ST04, DBACOCKPIT, ST04_MSS, DB02, DB02_MSS, DB12, or DB13 by providing specially crafted inputs. This exploitation allows the execution of malicious database commands, which can lead to:

• Data Retrieval: Unauthorized access to sensitive information stored in the database
• Data Modification or Destruction: Alteration or deletion of data, compromising data integrity
• Privilege Escalation: Gaining administrative control over the database instance

Solution

• Apply the correction instructions provided with this note and implement the correction as per the provided guidelines.
• Create messages in transaction SE91: for message 0Q 150, enter message class 0Q and message number 150, then enter the text "Parameter &1 contains an illegal special character" and save; for message 0Q 104, repeat the steps for message number 104 and enter the text "Schema name > &1< contains an impermissible special character" and save.
• Ensure that only trusted system administrators and personnel responsible for system tuning have access to the SQL Server database monitor transactions. For systems using SAP_BASIS version 6.40 (e.g., ECC 5.0), also create message 0Q 104.
• If your system is on SAP_BASIS support package levels 7.0 SP12 or older, or 7.10 SP2 or older, you may need to manually apply the source code correction or restrict access to the SQL Server database monitor transactions.

Affected components

• SAP_BASIS (620 to 640, 700 to 702, 710 to 730)