SAP Security Note
High priority
SAP security note 1638520, "Update #1 to Security Note 1594110", is a program error note released on 14.02.2012. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Correction instructions provided for the vulnerability (Code Injection) addressed in Security Note 1594110 must be corrected for the following releases: All releases 4.6B to 7.31.
Solution
Affected by the correction is function module "FUNCTION_CREATE_REMOTE" only. Please apply the support package mentioned in this note at least, or the respective correction instruction after note 1594110 or the correction instructions contained in it have been applied.
Reason and prerequisites
Security Note 1594110 contains correction instructions which are erroneous. The implementation of Security Note 1594110 is a prerequisite for applying this note.
References
This note refers to
Affected components
- SAP_BASIS 46B to 46D
- SAP_BASIS 620 to 640
- SAP_BASIS 700 to 702
- SAP_BASIS 710 to 730
- SAP_BASIS 731
- SAP_BASIS 800 to 802
Full note on SAP: SAP Support Launchpad note 1638520
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
