Missing authentication in Business Communication Broker, SAP security note 1548548

SAP security note 1548548, "Missing Authentication in Business Communication Broker", is a note released on September 12, 2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

SAP Security Note 1548548 addresses a critical vulnerability in the Business Communication Broker (BCB). This vulnerability allows malicious users to exploit BCB functions and discover related information, potentially leading to privilege escalation.

A malicious user can use functions of the Business Communication Broker without proper access restrictions, discover information related to the Business Communication Broker, and potentially escalate privileges within the system.

Solution

If you do not utilize the Java runtime of BCB, you can make the BCB application inaccessible by removing its alias name. Follow these steps using the Visual Administrator:

• Access Visual Administrator: navigate to <Server X> → Services → HTTP Provider.
• Modify Runtime Settings: select the "Runtime" tab, and under the host screen choose "default".
• Remove Application Aliases: go to the "Application Aliases" tab, locate "bcb", "bcbtest", and "ccsui", and uncheck the checkboxes next to these aliases.
• Save Changes: click "Save Properties", then click "Clear Cache". No restart is required.

After these steps, accessing the BCB application via http://<host>:<port>/bcb will result in a "404 Not Found" error.

Reactivation: to make the BCB application accessible again, repeat the above steps and recheck the checkboxes for the aliases. Redeployment: if you redeploy the bcbici.ear application after making these changes, the application will become accessible again; you will need to repeat the procedure to restrict access.

If you require the Java runtime of BCB, you should upgrade by applying the latest Support Package, or patch by deploying a patch with the appropriate patch level as specified in the "SP Patch Level" section of this note.

CVSS

Score 7.5 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

References

• Security Note 1623565 – Update #1 to Security Note 1548548

Affected components

• SAP-JEE 6.40
• SAP_JTECHS 6.40 to 7.02
• SAP J2EE ENGINE 6.40
• SAP JAVA TECH SERVICES 6.40, 7.00, 7.01, 7.02