Directory traversal in RE-BD and RE-RT, SAP security note 1574302

SAP security note 1574302, “Directory traversal in RE-BD and RE-RT”. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

RE-BD and RE-RT contain a vulnerability that allows a malicious user to potentially write arbitrary files on the remote server, which could lead to data corruption or alteration of system behavior.

Solution

The programs addressed in the correction instructions are used in RE-BD and RE-RT (RE-Classic) for legacy data transfer. Given that RE-Classic is an older product with a successor, RE-FX (see also SAP Note 443311), the critical coding within these programs has been removed. After applying the correction, the programs will no longer function. If you continue to use these programs, please submit a customer message under the subject areas RE-BD or RE-RT referencing this note.

Reason and prerequisites

RE-BD and RE-RT fail to correctly validate the path to which a user-submitted file is written. This oversight allows a malicious user to potentially overwrite data in the remote system.

References

• SAP Note 1599072 – Directory traversal in RE-BD
• SAP Note 1509424 – RE-Classic Potential Directory Traversal
• SAP Note 1497003 – Potential directory traversals in applications

Affected components

• SAP_APPL 40B
• SAP_APPL 45B
• SAP_APPL 46B
• SAP_APPL 46C
• SAP_APPL 470
• SAP_APPL 500
• SAP_APPL 600
• SAP_APPL 602
• SAP_APPL 603
• SAP_APPL 604
• SAP_APPL 605