Missing authorization check in message server, SAP security note 1773912

SAP security note 1773912, "Missing authorization check in message server", is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An unauthenticated user can use functions of the message server to which access should be restricted. This may result in an escalation of privileges.

Solution

Please apply a kernel with the patch level mentioned in this note, or a higher patch level.

Reason and prerequisites

The message server does not contain authorization checks for verifying a user’s authorization to access some of its functions. This may result in undesired system behavior or even enable a denial-of-service attack.

CVSS

Score 6.3 Vector: AV:N/AC:M/AU:S/C:N/I:N/A:C

Affected components

• KRNL32NUC: 6.40 to 6.40EX2, 7.20 to 7.20, 7.20EXT to 7.20EXT, 7.21 to 7.21, 7.21EXT to 7.21EXT
• KRNL32UC: 6.40 to 6.40EX2, 7.20 to 7.20, 7.20EXT to 7.20EXT, 7.21 to 7.21, 7.21EXT to 7.21EXT, 7.38 to 7.38
• KRNL64NUC: 6.40 to 6.40EX2, 7.20 to 7.20, 7.20EXT to 7.20EXT, 7.21 to 7.21, 7.21EXT to 7.21EXT, 7.38 to 7.38
• KRNL64UC: 6.40 to 6.40EX2, 7.20 to 7.20, 7.20EXT to 7.20EXT, 8.03 to 8.03, 8.04 to 8.04, 7.21 to 7.21, 7.21EXT to 7.21EXT, 7.38 to 7.38
• KERNEL: 6.40 to 6.40, 7.20 to 7.21, 8.03 to 8.04, 7.38 to 7.38