Directory traversal in BW statistics, SAP security note 1150499

SAP security note 1150499, "Directory traversal in BW statistics". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An error in BW allows statistics data to be written via the remote server, possibly corrupting data or altering system behavior.

Solution

SAP NetWeaver 7.0 BI

• Import Support Package 18 for SAP NetWeaver 7.0 BI (BI Patch 18 or SAPKW70018) into your BI system. The Support Package is available when Note 1136882 "SAPBINews BI 7.0 Support Package 18", which describes this Support Package in more detail, is released for customers.
• In urgent cases, you can implement the correction instructions as an advance correction.
• Important: you must first read Note 875986, which provides information about transaction SNOTE.

To provide information in advance, the notes mentioned above may already be available before the Support Package is released. In this case, the short text of the note contains the words "Preliminary version".

Reason and prerequisites

An error occurs for the statistics export when the system checks paths to which data is written that was generated by the statistics. An attacker can use this to overwrite data and files that may exist.

References

Affected components

• SAP_BW (700 to 702)
• SAP_BW_VIRTUAL_COMP (700 to 701)