Misuse of the search function in transaction SM51, SAP security note 1433101

SAP security note 1433101, "Misuse of the search function in transaction SM51", is a program error note released on 14.09.2010. Below are the symptom and SAP recommended solution.

Description

Symptom

The search function in transaction SM51 is misused.

Solution

Import the Support Package specified in the note.

If the error "DBIF_RSQL_SQL_ERROR in CLM_CWB_NOTE_FUNC_SAVE" occurs in a system with MS SQL server when you implement the correction instructions, you must first implement Note 1377270.

Reason and prerequisites

The trace search function in transaction SM51 can be misused on certain UNIX-based operating systems to execute processes directly on the operating system. This may also lead to an unrequired extension of authorizations (privilege escalation).

Transaction SM51 and the function module TH_GREP can be executed only by users who have the administration role S_ADMI_FCD. As a result, possible misuse is reduced to only this user group.