Potential information disclosure relating to files exported from SAP HANA with EXPORT statement, SAP security note 2252941

SAP security note 2252941, “Potential Information Disclosure in SAP HANA Export Function”, is a program error note released on January 12, 2016. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

SAP HANA users with the system privilege EXPORT can export table content to the server's file system. These exported files can contain confidential content (depending on the exporting user's actions and privileges). Other users with access to the server's file system can access these files depending on the file access privileges on the file system level.

Solution

An improvement for the security of the export function has been added. A configuration option for adjusting the access permissions for the exported files is now available. The SAP HANA administrator can configure the access permissions set by HANA for exported files in the indexserver.ini configuration file, under the [import_export] section, using the file_security parameter. The available settings are:

• high: Exported files are readable and writable only by the owner (600 on Linux).
• medium: Exported files are readable and writable by the owner and readable by the group (640 on Linux). [Default]
• low: Exported files are readable by all users and writable by the owner and group only (664 on Linux).

This configuration option and the changed default are available with HANA SPS11 (revision 110) and with revision 102.03 for SPS10.

Workaround:

• Operating System Level: Restrict access to the files by limiting user access to the server. Additionally, set the file access permissions for the exported files to the desired values using operating system tools.
• Database Level: Grant EXPORT/IMPORT privileges to a restricted set of users only.

Reason and prerequisites

If the exported file's access permissions on the file system are set too broadly, other users at the operating system level can access the file. SAP HANA's previous default for the file access permissions of exported files was 644 on Linux, making them readable by all operating system users on the server.

CVSS

Score 1.7 Vector: AV:L/AC:L/Au:S/C:P/I:N/A:N

Affected components

• SAP HANA Database (HDB) 1.00 to 1.00