FI-CA Potential Directory Traversal-Additional corrections, SAP security note 1608755

SAP security note 1608755, "FI-CA: Potential Directory Traversal – Additional corrections", is a program error note released on 10.01.2012. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Potential Directory Traversal in the following component: XX-CSC-ES-FICA

Solution

Kindly follow the steps mentioned below:

• Create Logical File Path using transaction code FILE: the following logical file name has been created to enable the validation of physical file names: FICA_FKK_ID_ES_FILEPATH with Name Logical file path for Spain Incoming file.
• Logical File Name using transaction code FILE: FICA_RFEBESCSB00_FILE with Name Logical File for Bank statement Spain.
• Apply the attached correction instructions.

Reason and prerequisites

The programs contained in the correction instructions contain vulnerabilities through which a malicious user can potentially read arbitrary files on the remote server, possibly disclosing confidential information. Some of the programs contained in the correction instructions contain a vulnerability through which a malicious user can potentially write arbitrary files on the remote server, possibly corrupting data or altering system behavior.

Affected components

• SAP_APPL (470, 600, 602, 603, 604, 605, 606)