Directory traversal in CRM_EDR_UPLOAD_DATA/-DOWNLOAD_DATA, SAP security note 1484712

SAP security note 1484712, "Directory traversal in CRM_EDR_UPLOAD_DATA/-DOWNLOAD_DATA", was released on 10.08.2010. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An error in CRM_EDR_UPLOAD_DATA or CRM_EDR_DOWNLOAD_DATA allows data to be read and written across the network.

Solution

Implement the attached corrections.

Reason and prerequisites

CRM_EDR_UPLOAD_DATA or CRM_EDR_DOWNLOAD_DATA displays an error during the check of paths to which data that is transferred by a user is written. An attacker can use this to transfer data to the remote system or to possibly overwrite existing data.

References

• 888889 – Automatic checks for security notes using RSECNOTE (outdated)

Affected components

• BBPCRM versions 600, 700, 701