SAP Security Note
HotNews
SAP security note 1390941, "Incomprehensible characters when executing 3.X Web template", is an external error note released on 11.01.2010. Below are the symptom and SAP recommended solution.
Description
Symptom
1. You execute a BW 3.X Web template. The Internet Explorer only displays incomprehensible characters,
2. or the Web report is corrupt, or the functions are incorrect.
Solution
- We urgently recommend that you use the WAD 3.X on the operating system Windows Vista. (Under Vista, the DHTML control of the WAD is not affected by any MS security updates). Refer to Note 1050174 (this is also valid for the WAD 3.X) for information about the installation of dhtmled.msi.
- Go to Microsoft KB956844 where Microsoft explains the changed behavior of the DHTML control used in the WAD. Due to the changes described, we advise against using the WAD 3.X for editing Web templates after the MS security update mentioned above has been implemented on the PC. Note that you can use the Microsoft Patch to change or delete customer-specific HTML template code. If KB956844 exists in your system, create backup copies of the Web templates before you edit them using the WAD 3.x to ensure that your Web templates are not destroyed (via transaction SE38: RS_TEMPLATE_MAINTAIN).
- You can remove the Unicode meta tag in the Web template manually (via transaction SE38: RS_TEMPLATE_MAINTAIN). This procedure corrects the display of incomprehensible characters (Mojibake), provided no more HTML code has been changed or deleted due to the security update.
Reason and prerequisites
1. The PC on which the BEx Web Application Designer 3.x (WAD 3.x) is installed has the operating system Windows 2000, Windows Server 2003, or Windows XP (refer to the platform validity: MS09-046).
2. The security update for Windows XP (KB956844) was implemented.
3. When you edit data in the Web Application Designer 3.x, a META tag is inserted into the template. This tag declares the source text as Unicode: <META http-equiv=Content-Type content="text/html; charset=unicode"> Furthermore, you can change or delete customer-specific HTML code of the template. For further information, see Microsoft KB956844, section "More Information".
Full note on SAP: SAP Support Launchpad note 1390941
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].




