Authority-check not working properly if used without fields, SAP security note 2054616

SAP security note 2054616, “Authority-check not working properly if used without fields”. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An authenticated user can use functions of BC-SEC-AUT to which access should be restricted. This may result in an escalation of privileges.

Solution

Import a kernel (disp+work) with a patch level of at least:

• Release 7.21: PL 316
• Release 7.40: PL 77
• Release 7.41: PL 43
• Release 7.42: PL 9

For more information about download and installation, refer to SAP Note 19466.

Reason and prerequisites

The authority-check returns wrong results if it is called without a field and the user has no authorizations for the tested authorization object. The correct sy-subrc should be 12 in this case.

The error is a side effect of Note 2025703 – Performance of AUTHORITY-CHECK. This document also solves side effects related to that note.

CVSS

Score 4.6 Vector: AV:N/AC:H/AU:S/C:P/I:P/A:P

References

Affected components

• KRNL32NUC 7.21 to 7.21
• KRNL32NUC 7.21EXT to 7.21EXT
• KRNL32UC 7.21 to 7.21
• KRNL32UC 7.21EXT to 7.21EXT
• KRNL64NUC 7.21 to 7.21
• KRNL64NUC 7.21EXT to 7.21EXT
• KRNL64NUC 7.40 to 7.40
• KRNL64NUC 7.41 to 7.41
• KRNL64NUC 7.42 to 7.42
• KRNL64UC 7.21 to 7.21
• KRNL64UC 7.21EXT to 7.21EXT
• KRNL64UC 7.40 to 7.40
• KRNL64UC 7.41 to 7.41
• KRNL64UC 7.42 to 7.42
• KERNEL 7.21 to 7.21
• KERNEL 7.40 to 7.40
• KERNEL 7.41 to 7.41
• KERNEL 7.42 to 7.42