SAP Security Note
High priority
SAP security note 2449757, "[CVE-2017-16689] Additional Authentication check in Trusted RFC on same system", is a program error note released on 12.12.2017. Below are the symptom and SAP recommended solution.
Description
Symptom
A Trusted RFC connection can be established to a different client or a different user on the same system, although no explicit Trusted/Trusting Relation to the same system has been defined via transaction SMT1.
Solution
A new profile parameter is introduced with the kernel patch of this SAP Note:
rfc/selftrust (Possible values: 0 or 1)
- Value 1 (Default): This is the previous behavior before the kernel patch. The system trusts itself without an explicit Trusted/Trusting Relation, and the secure use of Trusted/Trusting in the same system is solely defined via S_RFCACL authorizations.
- Value 0: A Trusted RFC connection can only be established to a different client or a different user on the same system if an explicit Trusted/Trusting Relation to the own system is defined via transaction SMT1.
This document is associated with a known side effect reported in 2614667 – Parameter rfc/selftrust is not working.
Reason and prerequisites
Trusted RFC does not require a Trusted/Trusting Relation from the system to itself. A system always trusts itself. The trust relationship maintained in SMT1 is used as a secure way to identify remote trusted systems. For calls on the same system, this is not necessary as the RFC infrastructure always knows that a call came from the same system in a secure way.
Client and user switches with RFC calls can be controlled with appropriate S_RFCACL authorizations in the receiving client. However, especially in scenarios with a central user management, one may want to specify uniform S_RFCACL authorizations for all or many systems and allow or deny local Trusted RFCs via Trusted/Trusting relationships.
CVSS
Score 7.6 / 10 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
References
Referenced by
Full note on SAP: SAP Support Launchpad note 2449757
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].