SAP Security Note
High priority
SAP security note 1594978, "Directory Traversal in FI-CA", is a program error note released on 12.07.2011. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Potential directory traversal in the FI-CA component.
Impact: read access – ability to read arbitrary files on the server; write access – ability to write arbitrary files, potentially corrupting data or altering system behavior.
Solution
To mitigate this vulnerability, implement the attached correction instructions provided in the note. Additionally, ensure that the prerequisite corrections from Note 1497003 are applied before implementing this security note.
Logical file names and paths have been established to validate physical file names securely. It’s recommended to structure directories based on user or program names to enhance security and reduce dependencies among programs.
References
This note refers to
Referenced by
Affected components
- FI-CA 464
- FI-CA 471
- FI-CA 472
- FI-CA 600
- FI-CA 602
- FI-CA 603
- FI-CA 604
- FI-CA 605
Full note on SAP: SAP Support Launchpad note 1594978
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].