Code injection vulnerability in SV-SMG-SDD, SAP security note 1649441

SAP security note 1649441, “Code injection vulnerability in SV-SMG-SDD”, is a program error note released on 10.04.2012. Below are the symptom and SAP recommended solution.

Description

Symptom

SV-SMG-SDD contains code that permits the execution of arbitrary program code of the user’s choice. An attacker can control the system’s behavior or potentially escalate privileges by executing malicious code without having legitimate credentials.

Solution

This issue occurs in ST-PI releases 2008_1_* with support package 04 or lower. To resolve, install a recent version of ST-PI (ST-PI 2008_1_* with support package 05 or higher).

Reason and prerequisites

The program code allows defining and executing user-defined code that changes the system’s behavior. A valid and authenticated user with authorization to create and execute ABAP reports or execute function modules (SE37) is required. Depending on the code, the user can:

• Inject and run their own code
• Obtain additional information that should not be displayed
• Modify or delete data
• Modify system output
• Create new users with higher privileges
• Perform a denial-of-service attack