Lacks proper input validation in SDCC Download Function Module, SAP security note 2037304

SAP security note 2037304, "Lacks proper input validation in SDCC Download Function Module", released on 16.02.2016. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An SDCCN download function module is not checking the validity of the input parameters.

Solution

Implement the coding correction of this SAP Note.

Reason and prerequisites

A SDCCN function module is not checking the input parameters. After implementing this SAP Note, only validated values are allowed as input parameters.

CVSS

Score 8.5 Vector: AV:N/AC:M/Au:S/C:C/I:C/A:C

Affected components

• ST-PI: 2008_1_620 to 2008_1_640
• ST-PI: 2008_1_700 to 2008_1_710