FI Potential Directory Traversal, SAP security note 1533776

SAP security note 1533776, "FI: Potential Directory Traversal", is released on 14.12.2010. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Potential Directory Traversal in the following components: FI-GL-GL-F, CA-JVA.

Path traversal vulnerability allows a malicious user to potentially write or delete arbitrary files on the remote server, which could lead to data corruption or alteration of system behavior.

Solution

Please refer to Note 1497003 for additional information and instructions. The corrections from this note must be applied before implementing the changes from Note 1533776.

Logical file names used in this solution: FI_TAX (programs RFUMSV00, RFASLD20, RGJVTAX2) and FI_RFASLDPC (program RFASLDPC). All logical file names use the logical file path FI_ROOT.

Program RFASLDPC is used to copy files created by several other programs to the frontend PC. A high-level directory should be configured for RFASLDPC to ensure it cannot access unrelated files.

Reason and prerequisites

The vulnerability arises from programs containing flaws that permit unauthorized file operations. To effectively implement this note, corrections from Note 1497003 are a prerequisite.

References

• Note 1517472 – FI-GL-IS: Potential Directory Traversal
• Note 1497003 – Potential directory traversals in applications
• Note 1063617 – RFASLD20: Dump OPEN_DATASET_NO_AUTHORITY
• Note 877045 – RFUMSV00: Connection of doc splitting for tax payable pstngs
• Note 880864 – for EA-APPL 500 and 600

Affected components

• SAP_APPL: Release 31I to 31I; Release 40B to 40B
• EA-APPL: Release 500 to 500