Directory traversal in VIRSANH, VIRSAHR and VIRSA, SAP security note 1603379

SAP security note 1603379, "Directory traversal in VIRSANH, VIRSAHR and VIRSA", is a note released on 10.04.2012. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

VIRSANH, VIRSAHR and VIRSA contain a vulnerability through which a malicious user can potentially read or write arbitrary files on the remote server, possibly disclosing, corrupting data, or altering system behavior.

Solution

Please apply the SAP Note 1603379 corrections carefully.

Reason and prerequisites

VIRSANH, VIRSAHR and VIRSA fail to correctly validate the path that is used to reference a file that is read from the remote server. Additionally, VIRSANH, VIRSAHR and VIRSA do not correctly validate the path to which a user-submitted file is written. As a result, a malicious user can potentially disclose or overwrite data in the remote system.

Affected components

• VIRSANH
• VIRSAHR
• VIRSA