SAP Security Note
High priority
SAP security note 1755530, "Directory traversal in IS-B-DP-EDT for report SAPLKXDM", is a note released on 13.11.2012. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
IS-B-DP-EDT contains a vulnerability through which an attacker can potentially write arbitrary files to the remote server, possibly corrupting data or altering system behavior.
Solution
Please refer to note 1497003 for additional information and instructions. The corrections from note 1497003 are a prerequisite for the implementation of this note.
Reason and prerequisites
1. The programs contained in the correction instructions have vulnerabilities that allow a malicious user to potentially read arbitrary files on the remote server, possibly disclosing confidential information.
2. Some programs in the correction instructions contain a vulnerability that allows a malicious user to potentially write arbitrary files on the remote server, possibly corrupting data or altering system behavior.
Affected components
- SAP_ABA 620
- SAP_ABA 640
- SAP_ABA 700-702
- SAP_ABA 710-711
- SAP_ABA 730
- SAP_ABA 731
Full note on SAP: SAP Support Launchpad note 1755530
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].