Update 1 to Security Note 1616058, SAP security note 1631354

SAP security note 1631354, "Update 1 to Security Note 1616058", is a program error note released on 16.05.2012. Below are the symptom and SAP recommended solution.

Description

Symptom

Security note 1616058 has been rereleased. It previously provided workaround instructions which are no longer valid as corrections are available. The corrections introduce an incompatible change for the SPML service.

Solution

If you applied the workaround previously provided with Security Note 1616058, please revert all changes and update your AS Java to a Support Package or release where the issue is fixed. See the “SP Patch Level” section of Security Note 1616058 for details and available patches.

SAP NetWeaver 7.1 and higher: The URLs for the SPML service have a unique prefix and can be filtered out in the ICM on a rule basis. In the profile file, remove the modification handler icm/HTTP/mod_0 = PREFIX=/,FILE=$(DIR_GLOBAL)/security/data/icm_filter_rules.txt. If you no longer need the rule file, you can delete it from the specified directory. If you have disabled the alias “spml” in the HTTP provider service, connect with Visual Admin and navigate to the server node per instance, then HTTP provider, select “Application Alias”, check the application alias “spml”, and save the changes with “Save Properties”.

For all NetWeaver Releases: Remove all configured restrictions applied to URLs starting with “/spml/” from your firewall or load balancer in front of the NetWeaver AS Java.

Reason and prerequisites

Workaround instructions in security note 1616058 have been replaced by correction instructions. The correction introduces an incompatible change for the SPML service. After this change, the SPML service checks every SPML request for the availability of an HTTP header with name “X-Requested-With” and value “XMLHttpRequest”. Patches for SAP products that use the SPML interface are available. For more information, check the “Related Notes” section in Security Note 1616058. If you are using third-party SPML clients which cannot be updated, you may switch off the protection by changing the UME property ume.spml.http_header_check_active to false (a cluster restart is required). If this property is set to false, additional protection mechanisms like URL filter via ICM, load balancers, or firewalls have to be applied as described in Security Note 1616058.

References