SAP Security Note
SAP security note 1598308, "Connection to the SAP virus scan interface", is a note released on 13.12.2011. Below are the symptom and SAP recommended solution.
Description
Symptom
Messages that are received via the SAPconnect SMTP interface cannot be checked for viruses.
Solution
Implement the corrections using the Note Assistant or import the relevant Support Package. This enables the connection to the SAP virus scan interface in SMTP inbound processing. After implementing the corrections, the connection is inactive (the system behaves as before the corrections were applied).
Use transaction VSCANPROFILE to activate and set parameters for the virus scan interface. The profile /SBCOMS/SMTP_INBOUND is relevant for SAPconnect and is created automatically when an e-mail is received via SAPconnect in the current client after applying the corrections.
It’s recommended that SMTP messages are already scanned for viruses in upstream Mail Transfer Agents (MTAs) before they are routed to the SAP system. Carefully assess whether the virus scanner can be used in SAPconnect inbound processing and use it only in exceptional cases.
For more information, refer to SAP Note 639486.
Reason and prerequisites
No connection to the SAP virus scan interface exists.
CVSS
Score 0
References
This note refers to
- 1690160 – BCS: Application-specific VSI profile during sending
- 956935 – Incorrect name for message/rfc822 attachments
- 976121 – Incorrect mail title if e-mail received by SMTP
- 1145536 – Incoming send requests are not reorganized
- 1073789 – Attachment disappears from an inbound e-mail
- 1293171 – Special characters in disclosures cannot be read
- 1020038 – E-mail receipt: "No Reference" when subject field is empty
- 1377096 – Termination if incoming e-mail contains errors
- 891936 – File name extension always in uppercase letters
- 960880 – Error occurs in the case of status mails
- 1041676 – SBWP: Displaying Multipart/Related documents in SAPGUI
- 1090262 – Enhancement of the ‘Sensitivity’ sending attribute
- 1114443 – BCS: RFC822 messages receive the file name extension ‘EML’
- 1179952 – Check existence of SAP basis virusscan profiles
- 1160489 – BCOM: Attachments are missing from incoming e-mails
- 1410926 – E-mail receipt: Embedded graphic is not displayed
- 1586256 – Inbound HTML attachments are not displayed correctly
Full note on SAP: SAP Support Launchpad note 1598308
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].