Code injection vulnerability in SV-SMG-UMP, SAP security note 1940405

SAP security note 1940405, "Code injection vulnerability in SV-SMG-UMP", is a program error note released on 08.04.2014. Below are the symptom and SAP recommended solution.

Description

Symptom

SV-SMG-UMP contains code that permits the execution of operating system code of the user’s choice, such as shell commands. An attacker can control the system’s behavior or potentially escalate privileges by executing malicious code without possessing legitimate credentials.

Solution

Apply the attached correction.

Reason and prerequisites

The program code allows user-defined code execution that changes the system’s behavior at the operating system level. A valid and authenticated user is required with authorization to execute function modules on the ABAP server level. Commands or executables with certain properties on the underlying operating system must exist.

Depending on the operating system commands, the user can:

• Inject and run shell commands with a maximum length of 3 on the operating system level with privileges of the ABAP system user.
• Obtain additional information that should not be displayed.
• Modify or delete data.
• Modify the system’s output.
• Create new users with higher privileges.
• Perform a denial of service attack.

CVSS

Score 4.6 Vector: AV:N/AC:H/AU:S/C:P/I:P/A:P