SAP security note 1518727, "EC-PCA: Potential Directory Traversal", is released on 14.12.2010. Below are the symptom, reason and prerequisites, SAP recommended solution, references and affected software components.
Description
Symptom
Potential Directory Traversal in the following components: EC-PCA.
Solution
The program RPCAUMS1 is obsolete. The correction will deactivate the program to ensure that it cannot be abused.
Reason and prerequisites
The programs contained in the correction instructions contain vulnerabilities through which a malicious user can potentially read arbitrary files on the remote server, possibly disclosing confidential information. Some of the programs contained in the correction instructions contain a vulnerability through which a malicious user can potentially write arbitrary files on the remote server, possibly corrupting data or altering system behavior.
References
Affected components
- SAP_APPL (31I to 605)
Full note on SAP: SAP Support Launchpad note 1518727
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].