CA-DMS Potential Directory Traversal, SAP security note 1537765

SAP security note 1537765, “CA-DMS: Potential Directory Traversal”, is a program error note released on 14.12.2010. Below are the symptom, reason and prerequisites, SAP recommended solution, references and the affected software components.

Description

Symptom

Document Management System (DMS) contains a vulnerability through which a malicious user can potentially write arbitrary files on the remote server, possibly corrupting data or altering system behavior.

Solution

Refer to Note 1497003 for additional information and instructions. The corrections from Note 1497003 are a prerequisite for implementation of this note.

Logical file names used in this solution:

• The following logical file name has been created in order to enable the validation of physical file names: DMS_LOG_FILE_PATH.

Reason and prerequisites

The function modules CV_WRITE_TABLE2FILE and CVDS_WRITE_TABLE2FILE fail to validate the path a user-submitted file is written to. This means that an attacker can potentially overwrite data on the remote system. Note 1497003 is a prerequisite for this note.

References

Affected components

• SAP_APPL (46B, 46C, 470, 500, 600, 602, 603, 604, 605)