FI Potential Directory Traversal – Austria, SAP security note 1533445

SAP security note 1533445, "FI: Potential Directory Traversal – Austria". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Potential Directory Traversal for RFIDITSR12

Solution

Please refer to note 1497003 for additional information and instructions. The corrections from note 1497003 are a prerequisite for implementation of this note.

Logical File Name Used in this Solution

The following logical file names have been created in order to enable the validation of physical file names: FI_RFIDITSR12_FILE

Program using this logical filename: RFIDITSR12

Logical File Path Used in this Solution

FI_CBR-FD_PATH

The application RFIDITSR12 is passing an additional parameter parameter_1 (sy-cprog) to the Function Module FILE_VALIDATE_NAME. This will allow a customer to insert the parameter while configuring the physical paths for the Logical File Name FI_RFIDITSR12_FILE.

Reason and prerequisites

• The programs contained in the correction instructions contain vulnerabilities through which a malicious user can potentially read arbitrary files on the remote server, possibly disclosing confidential information.
• Some of the programs contained in the correction instructions contain a vulnerability through which a malicious user can potentially write arbitrary files on the remote server, possibly corrupting data or altering system behavior.

References

• 1888785 – List of notes released for RFIDITSR12
• 1497003 – Potential directory traversals in applications

Affected components

• SAP_APPL 46C
• SAP_APPL 470
• SAP_APPL 500
• SAP_APPL 600
• SAP_APPL 602
• SAP_APPL 603
• SAP_APPL 604
• SAP_APPL 605