SAP Security Note
SAP security note 1508380, "FI: Potential Directory Traversal-FRANCE", was released on 14.12.2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
XX-CSC-FR contains a vulnerability through which a malicious user can potentially read arbitrary files on the remote server, possibly disclosing confidential information.
Solution
Please install the corresponding Support Pack or download the correction instruction attached to this note.
Reason and prerequisites
XX-CSC-FR fails to correctly validate the path with which a file that is read from the remote server is referenced. Through this, an attacker can potentially point the program to an arbitrary other file on the system, disclosing its contents.
References
Affected components
- SAP_APPL 46B
- SAP_APPL 46C
- SAP_APPL 470
- SAP_APPL 500
- SAP_APPL 600
- SAP_APPL 602
- SAP_APPL 603
- SAP_APPL 604
- SAP_APPL 605
Full note on SAP: SAP Support Launchpad note 1508380
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].