Code injection vulnerability in FS-BA-TO-DE, SAP security note 1580132

SAP security note 1580132, “Code injection vulnerability in FS-BA-TO-DE,” is a note released on July 12, 2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

FS-BA-TO-DE contains code that permits the execution of arbitrary program code of the user’s choice. A malicious user can control the system behavior or escalate privileges by executing malicious code without having legitimate credentials.

Solution

Apply the following automatic correction.

Reason and prerequisites

The program code allows defining and executing user-defined code that changes system behavior. A valid and authenticated user is required. Depending on the code, the user can:

• Inject and run their own code
• Obtain additional information that should not be displayed
• Modify or delete data
• Perform a denial of service attack

References

• Automatic checks for security notes using RSECNOTE (outdated)

Affected components

• Financial Services > Bank Analyzer > Tools > Derivation Tool (FS-BA-TO-DE)