SAP Security Note
High priority
SAP security note 1508990, "Code injection vulnerability in package SDB2", is a program error note released on 14.12.2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Package SDB2 contains code which allows to execute arbitrary program code of the user’s choice. A malicious user can therefore control the behavior of the system or can potentially escalate privileges by executing malicious code without legitimate own credentials.
Solution
Apply support package according to the SAP release as specified in the section "Reference to Support Packages".
Reason and prerequisites
The program code contains a possibility to define and execute code of the user’s choice which changes the system’s behavior. A valid and authenticated user is required. Depending on the code the user can inject and run their own code, the user may obtain additional information which should not be displayed, they may be able to modify data, delete data, modify the output of the system, or create new users with higher privileges or perform a denial of service attack.
Affected components
- SAP_BASIS 640
- SAP_BASIS 700
- SAP_BASIS 701
- SAP_BASIS 702
- SAP_BASIS 710
- SAP_BASIS 711
- SAP_BASIS 730
Full note on SAP: SAP Support Launchpad note 1508990
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].