Dangerous ABAP Commands; DELETE REPORT in RSBTCDRP, SAP security note 1576055

SAP security note 1576055, “Dangerous ABAP Commands; DELETE REPORT in RSBTCDRP”, is a program error note released on 14.06.2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

SAP Batch contains code that permits the execution of arbitrary program code of the user’s choice. A malicious user can therefore control the behavior of the system or potentially escalate privileges by executing malicious code without having their own legitimate credentials.

Solution

Apply the support package mentioned in this note at least, or follow the respective correction instructions.

Reason and prerequisites

The program code includes a functionality that allows the deletion of code, which can alter the system’s behavior. A valid and authenticated user is required. Depending on the code, the user can:

• Delete data, i.e., programs
• Perform a denial of service attack

References

• Automatic checks for security notes using RSECNOTE (outdated)

Affected components

• SAP_APPL 31I
• SAP_APPL 40B
• SAP_APPL 45B
• SAP_BASIS 46A to 46D
• SAP_BASIS 610 to 640
• SAP_BASIS 700 to 702