SAP security note 2704878, "[CVE-2018-2497] Event not logged in SAP HANA database audit log", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
The security audit log of SAP HANA does not log SELECT events if these events are part of a statement with the syntax CREATE TABLE <table_name> AS SELECT.
Solution
The CREATE TABLE <table_name> AS SELECT event is logged by the audit action "SELECT". The improvement is implemented with the following versions:
- Revision 122.17 (for SAP HANA 1.00 SPS12)
- Revision 24.01 (for SAP HANA 2.0 SPS02)
- Revision 30 (initial shipment of SAP HANA 2.0 SPS03)
Update to these or later versions.
Reason and prerequisites
SAP HANA administrators can define in audit policies which events should be logged. Events for CREATE TABLE <table_name> AS SELECT are not logged as SELECT statements, even if the SELECT statement should be logged.
CVSS
Score 2.7 Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
Full note on SAP: SAP Support Launchpad note 2704878
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
