Medium priority
SAP security note 1584395, “Missing authorization check in BC-VMC”, is a note released on February 14, 2012. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An authenticated user can utilize functions within BC-VMC that should be restricted, potentially leading to an escalation of privileges.
Solution
Implement the relevant kernel patch to apply the necessary ABAP corrections. Please refer to the version details attached to this note for more information.
Reason and prerequisites
BC-VMC lacks the necessary authorization checks to verify a user’s permissions when accessing certain functions. This oversight may result in unintended system behavior and unauthorized access.
Affected components
- SAP_BASIS (700 to 731)
- SAP KERNEL (7.00, 7.01, 7.10, 7.11, 7.20 for both 32-BIT and 64-BIT configurations)
Full note on SAP: SAP Support Launchpad note 1584395
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].