SAP security note 1476739, "Dangerous ABAP Commands in Package GJVA", is a program error note released on 14.12.2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Joint Venture Accounting (JVA) contains programs that potentially allow the execution of arbitrary program code chosen by a user. A malicious user could control system behavior or escalate privileges by executing malicious code without legitimate credentials.
Solution
When a user attempts to run the affected programs, an information message referencing this note will be displayed, and the program will exit immediately.
Reason and prerequisites
The programs RGJJVDL1 and RGJJVDL2 are test and repair programs intended exclusively for SAP Hotline support to investigate issues in the Joint Venture Accounting setup and database. These programs must not be used by customers.
Affected components
- EA-APPL: 110
- EA-APPL: 200
- EA-APPL: 500
- EA-APPL: 600
- EA-APPL: 602
- EA-APPL: 603
- EA-APPL: 604
- EA-APPL: 605
Full note on SAP: SAP Support Launchpad note 1476739
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].