Unauthenticated system access via RFC or HTTP, SAP security note 1491645

SAP security note 1491645, “Unauthenticated system access via RFC or HTTP.” Below are the symptom and the SAP recommended solution.

Description

Symptom

This Security Note has been updated. For more detailed information, see Security Note 1605516.

Under certain conditions, an RFC or HTTP connection to an SAP system might be established even though incomplete authentication information is passed.

Solution

To resolve this issue, apply the following measures within your ABAP systems:

• Apply kernel patches and ABAP corrections: ensure your system’s kernel is patched to versions higher or equal to those mentioned under the ‘SP Patch Level’ tab, and apply the ABAP corrections attached to this note. Both kernel patches and ABAP corrections must be applied to all application servers to ensure all internal RFC and HTTP communications operate securely.
• Update external trust relations: ensure that both the trusting and trusted systems have the necessary kernel and ABAP patches applied. Use transaction SMT1 to delete existing trust relations and recreate them so they operate with the enhanced security level. Refer to SAP Note 1498973 for an analysis report and update report to upgrade existing trust relations.

Reason and prerequisites

Under specific conditions, it is possible to execute RFC or HTTP calls without successfully authenticating to the receiver system.

References

• Update #1 to Security Note 1491645
• Deleting SECSTORE entries during system export/system copy
• Problem with trust relationship after using HMAC
• RFC failure during upgrade when using HMAC