Missing logging in transactn for totals document correction, SAP security note 1410798

SAP Note 1410798
SAP Security Note
High priority

SAP security note 1410798, "Missing logging in transactn for totals document correction", is a program error note released on 10.02.2010. Below are the symptom and SAP recommended solution.

ComponentFinancial Services > Policy Management > Integration > Financial Accounting (FS-PM-IT-FI)

CategoryProgram error

PriorityHigh priority

TypeSAP Security Note

Version3

StatusReleased for Customer

Released on10.02.2010

LanguageEnglish (Master Language: German)

Description

Symptom

You are able to start the transaction for the modification or correction of totals documents. Using this transaction, it is possible to modify data that is relevant for account balancing without logging these changes. This is a security risk.

Solution

For an advanced correction, implement the source code corrections and perform the manual tasks.

Full note on SAP: SAP Support Launchpad note 1410798

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Basis line of business #/PM0/ABC_NCSD #Security