SAP Security Note
High priority
SAP security note 1675346, "Obsolete ITS services in FI-AA", is a program error note released on 08.05.2012. Below are the symptom and SAP recommended solution.
Description
Symptom
The ITS services in FI-AA listed here are obsolete and sometimes cause functional errors.
- SRAA
- ASCC
- ASEM
The applications may also be susceptible to XSS or XSRF attacks and therefore present a security risk for the system.
Solution
Import the relevant Support Package to deactivate the affected ITS services. It is not possible to do this manually by implementing this SAP Note. You can only delete all of the ITS services. In addition, the service nodes must be deleted using transaction SICF.
Reason and prerequisites
Due to the security policy, the obsolete ITS services mentioned above must be removed from the system.
Full note on SAP: SAP Support Launchpad note 1675346
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].