SAP security note 1675220, "Obsolete ITS services in FI-AR/AP." Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The ITS services in FI-AP/FI-AR listed here are obsolete and sometimes cause functional errors.
- SVA2
- SVB1
- SVB2
- SVB6
- SCA2
- SCB1
- SCB2
- SCB6
The applications may also be susceptible to XSS or XSRF attacks and therefore present a security risk for the system.
Solution
Import the relevant Support Package to deactivate the affected ITS services. It is not possible to do this manually by implementing this SAP Note. You can only delete all of the ITS services. In addition, the service nodes must be deleted using transaction SICF.
Reason and prerequisites
Due to the security policy, the obsolete ITS services mentioned above must be removed from the system.
Affected components
- SAP_APPL 500
- SAP_APPL 600
- SAP_APPL 602
- SAP_APPL 603
- SAP_APPL 604
- SAP_APPL 605
- SAP_APPL 606
Full note on SAP: SAP Support Launchpad note 1675220
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].