Connection to Virus Scan Interface in CA-GTF-IC-CHA, SAP security note 1699357

SAP security note 1699357, "Connection to Virus Scan Interface in CA-GTF-IC-CHA", is a program error note released on 13.08.2013. Below are the symptom and SAP recommended solution.

Description

Symptom

In the Integrated Communication Interface Mail Channel, the connection to the Virus Scan Interface is missing. This deficiency can allow malicious users to upload harmful content to the server, potentially tricking legitimate users into downloading and executing malicious files.

Solution

Implementation Steps

• 1. Implement Prerequisite: Apply SAP Note 1640285.
• 2. Manual Pre-Implementation Steps: Create Message Classes: IC_CCS_MCM in Package IC_CCS_MCM with messages 100 (“E-mail contained malicious content; content has been deleted”), 101 (“There is a problem with the virus scanner; contact your administrator”), 102 (“E-mail contained a blocked file or MIME type; content has been deleted”). Create Virus Scan Profile at SAP NetWeaver -> Application Server -> System Administration -> Virus Scan Interface -> Define Virus Scan Profiles, Profile Name /IC_CCS_MCM/ICI_MAIL, Profile Text “Viren Scan Profil for e-mail via Integrated Communication Interface”, with configuration parameters CUST_ACTIVE_CONTENT = 1, CUST_CHECK_MIME_TYPE = 1, CUST_MIME_TYPES_ARE_BLACKLIST = 1, blocking MIME types application/ecmascript, application/java-archive, application/javascript, application/x-jar, application/x-java-jar, application/x-javascript, application/x-shockwave-flash, application/x-silverlight, application/x-silverlight-2, application/x-silverlight-app, text/javascript. Adjust SEOSUBCO table entries with CLSNAME CL_CRM_MCM_MAIL_MESSAGE and CMPNAME CREATE_BY_BCB_MESSAGE; if there are already 5 entries, delete the existing entry to prevent issues during implementation.
• 3. Implement Correction Instructions: Follow the detailed correction instructions provided in the note for components WEBCUIF, SAP_ABA, CRMUIF, and CRMIS. Ensure all manual activities are performed accurately to avoid errors during the correction process.
• 4. Manual Post-Implementation Steps: Activate Virus Scan Profile via transaction SE38, program RSVSCANCUST_PROFILE, execute (F8), switch to change mode, select the entry related to ICI_MAIL, click Details, check the ACTIVE box and save your changes.

Reason and prerequisites

This security note introduces a new functional enhancement aimed at improving the secure storage of files on the SAP share system (e.g., on an application server). The enhancement ensures that the content and the reported type of a stored file are verified, allowing storage only for trusted application file types.

Prerequisite: Before implementing this note, ensure that SAP Note 1640285 is fully implemented.

CVSS

Score 0