Code injection vulnerability in BC-SRV-COM-FTP, SAP security note 1674132

SAP security note 1674132, “Code injection vulnerability in BC-SRV-COM-FTP”. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

BC-SRV-COM-FTP contains code that permits the execution of arbitrary program code of the user’s choice. An attacker can therefore control the behavior of the system, or can potentially escalate privileges by executing malicious code, without having their own legitimate credentials.

Solution

Please implement the correction instructions attached to this SNote.

Reason and prerequisites

The program code contains a possibility to define and execute user-defined code that changes the behavior of the system. Depending on the code, the user can:

• Inject and run their own code
• Obtain additional information that should not be displayed
• Perform a denial of service attack

CVSS

Score 6.0 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:P

References

• Update 1 to security note 1674132

Affected components

• Basis Components > Basis Services/Communication Interfaces > Communication Services: Mail, Fax, SMS, Telephony > File Transfer via FTP (BC-SRV-COM-FTP)