FI Potential Directory Traversal, SAP security note 1592964

SAP security note 1592964, "FI: Potential Directory Traversal", released on August 8, 2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Potential Directory Traversal in the following components: FI.

Solution

Please refer to SAP Note 1497003 for additional information and instructions. The corrections from SAP Note 1497003 are a prerequisite for the implementation of this note.

Logical file names used in this solution:

• FI_POSTING – software component: FI; programs using this logical file name: RFBIBL01; parameters used in this context: <PARAM_1> Program name.

Logical file paths used in this solution: FI_ROOT.

Reason and prerequisites

The programs contained in the correction instructions contain vulnerabilities through which a malicious user can potentially read arbitrary files on the remote server, possibly disclosing confidential information.

References

• SAP Note 1497003 – Potential directory traversals in applications
• SAP Note 723363 – Importing non-Unicode files in Unicode system not possible

Affected components

• SAP_APPL: 31I, 40B, 45B, 46B, 46C, 470, 500, 600, 602, 603, 604, 605