High Priority
SAP security note 1533447, "FI: Potential Directory Traversal – PL/HU/CZ/IT", is a program error note released on December 14, 2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Potential Directory Traversal vulnerability in RFASLD15.
Solution
Refer to SAP Security Note 1497003 for additional information and instructions. The corrections from this note are prerequisites for implementing Note 1533447.
Logical file name used in this solution: FI_RFASLD15_FILE, used by program RFASLD15. Logical file path used in this solution: FI_ECSL-CE_PATH. The application RFASLD15 passes an additional parameter (parameter_1 or sy-cprog) to the function module FILE_VALIDATE_NAME. This allows customers to configure the physical paths for the logical file name FI_RFASLD15_FILE.
Reason and prerequisites
- Vulnerabilities in the programs allow malicious users to read or write arbitrary files on the remote server.
- This could lead to disclosure of confidential information or corruption of data/system behavior.
References
Affected components
- SAP_APPL: Versions 31I, 40B, 45B, 46B, 46C, 470, 500, 600, 602, 603, 604, 605
- SAP_BASIS: Versions 46C, 620, 700, 701, 702-710
Full note on SAP: SAP Support Launchpad note 1533447
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].