SAP Security Note
Medium priority
SAP security note 1339326, “F&R: Remove hardcoded user name branches in code (security)”, is a note released on 08.10.2009. Below are the symptom, SAP recommended solution and reason and prerequisites.
Description
Symptom
No symptoms. SAP internal security audit.
Solution
Implement the correction instructions or install the associated Support Package.
Reason and prerequisites
Production code makes comparisons between sy-uname and hardcoded values. Security implications are negligible; however, the application may perform unexpectedly if the user name matches a hardcoded value. These comparisons have now been removed.
Full note on SAP: SAP Support Launchpad note 1339326
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].