Directory Traversal in Legacy system migration workbench, SAP security note 1577858

SAP Note 1577858
SAP Security Note
High priority

SAP security note 1577858, "Directory Traversal in Legacy system migration workbench", is a program error note released on 09.08.2011. Below are the symptom, SAP recommended solution and the affected software components.

ComponentBasis Components > Basis Services/Communication Interfaces > Initial Data Transfer > Legacy System Migration Workbench (ABAP Transaction LSMW)

CategoryProgram error

PriorityCorrection with high priority

TypeSAP Security Note

Version2

StatusReleased for Customer

Released on09.08.2011

LanguageEnglish

Description

Symptom

Few Legacy System Migration Workbench (LSMW) Function Modules and reports contain a vulnerability through which a malicious user can potentially read/write arbitrary files on the remote server, possibly corrupting data or altering system behavior.

Solution

Refer to note 1497003 for additional information and instructions. The corrections from note 1497003 are a prerequisite for the implementation of this note.

Logical file name used in this solution: /SAPDMC/LSMW_FILE
Logical file path used in this solution: /SAPDMC/LSMW_FILE_LP

Reason and prerequisites

These Function Modules or reports fail to correctly validate the path a user-submitted file is read/written to. This means that an attacker can potentially overwrite data on the remote system.

CVSS

Score 0

Affected components

SAP_BASIS 620 to 640
SAP_BASIS 700 to 702
SAP_BASIS 710 to 730

Full note on SAP: SAP Support Launchpad note 1577858

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Directory Traversal #Legacy System Migration Workbench #LSMW