Missing authorization check in SAP Kernel, SAP security note 1819139

SAP security note 1819139, "Missing authorization check in SAP Kernel", is a program error note released on December 10, 2013. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An authenticated ABAP Developer can use functions of the SAP Kernel to which access should be restricted. This may result in an escalation of privileges.

Solution

Apply the patch level mentioned in this note.

Some kernel call interfaces for handling files or directories were designed to support specific administration functions and should not be used for other purposes. Now, they reject calls if:

• The user does not have the same authorization as the one used for the administrative transactions.
• The call comes from an unknown program.
• The file or directory name contains suspicious characters.

In such cases, the call is rejected, and SY-SUBRC is set to 5 or 6. The kernel modifications do not affect the official administrative transactions.

Reason and prerequisites

SAP Kernel does not contain authorization checks for verifying an authenticated user’s authorization to access some of its functions. This may result in undesired system behavior.

CVSS

Score 4.9 Vector: AV:N/AC:H/AU:S/C:N/I:N/A:C

References

• Causes side effect: SAP Note 1929613 – ST11 and AL11 do not display many attributes – Unicode?

Affected components

• SAP KERNEL 7.00 to 7.01
• SAP KERNEL 7.10 to 7.20
• SAP KERNEL 7.20EXT to 7.20EXT
• SAP KERNEL 7.21 and 7.21EXT
• SAP KERNEL 7.38
• SAP KERNEL 7.40
• SAP KERNEL 7.41
• SAP KERNEL 6.40
• SAP KERNEL 7.2L