Corrections for ST-PI, SAP security note 1490437

SAP security note 1490437, "Corrections for ST-PI", is a program error note released on 08.03.2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The following problems were identified in the functions in ST-PI:

• Extensive authorizations for the object ‘S_RFC’ allow certain non-RFC-capable function modules to be called using an RFC user.
• It is possible to read files using an RFC access without sufficient authorization checks being carried out.
• Only one insufficient check of the import parameter is carried out for certain form routines for generating includes that are used to call function modules for Service Data Control Center (SDCCN) data download.

These affected functions are used during the download collection in the EarlyWatch Alert, during the central system administration, and in Business Process Monitoring in the Solution Manager.

Solution

To correct the problems described above, implement the attached source code corrections or import one of the Support Packages 2008_1_XXX Support Package 4 (XXX stands for the particular Release).

References

• 1861791 – OS CMD injection vulnerability in ST-PI
• 1552585 – SAP Solution Manager: Basic functions 7.1 SP1
• 888889 – Automatic checks for security notes using RSECNOTE (outdated)

Affected components

• ST-PI 2008_1_46C to 2008_1_710