Update 1 to Security Note 1686632, SAP security note 2102941

SAP security note 2102941, "Update 1 to Security Note 1686632", is a program error note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The original SAP Note 1686632 was unclear for:

• Releases 620 and 640
• Releases from 700 onwards in conjunction with kernel versions 720 and 721

When using a synchronous RFC in ABAP, the RFC destination "BACK" allows executing remote-enabled modules in the RFC caller’s context, provided the caller has the necessary RFC authorizations and the callback isn’t prohibited by RFC_CALLBACK_REJECTED (refer to SAP Note 1515925).

Note: RFC callbacks are only supported during synchronous RFCs. They are not supported during asynchronous, transactional, or background RFCs.

Solution

Refer to the updated version of SAP Security Note 1686632 for detailed instructions and information.

Reason and prerequisites

Using the ABAP statement CALL FUNCTION <func> DESTINATION <DEST> to call a synchronous RFC allows, within the remote function module (<func>), the use of a synchronous RFC with the predefined destination "BACK". This is achieved via CALL FUNCTION <funcBack> DESTINATION 'BACK' (RFC callback).

Prerequisite: If the RFC authorization check is activated (see SAP Note 93254) on the calling side, the caller must have the necessary RFC authorization. Otherwise, executing <funcBack> will terminate with an error.

Affected components

• KRNL32NUC, KRNL32UC, KRNL64NUC, KRNL64UC – Versions: 6.40 to 7.42
• SAP_BASIS – Versions: 620 to 740
• KERNEL – Versions: 6.40, 7.20 to 7.42

References