CTC Table White Lists and Authorization Checks, SAP security note 1446276

SAP security note 1446276, "CTC: Table White Lists and Authorization Checks", is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

You are using Central Technical Configuration (CTC templates) to install, configure, or update your system. These templates could pose a security risk and should be secured appropriately.

Solution

Implement this note to secure function modules used by the Central Technical Configuration environment.

If you apply the note manually, you must also create the following messages in message class S_LMCFG_LIB using transaction SE91:

• 026: No permission to view content of table &1
• 027: No permission to write content of table &1
• 028: No permission to truncate content of table &1
• 029: Table operation &1 not provided
• 030: No authorization to view content of table &1
• 031: No authorization to write content of table &1
• 032: No authorization to truncate content of table &1
• 033: No authorization for client-independent changes

All internal CTC-related function modules are protected by authorization object S_CTC. To grant permissions, assign role SAP_BC_CTC to the (administration) user if necessary.

Reason and prerequisites

Several ABAP-based functions used by CTC templates contain content that could be used maliciously.