Potential info. disclosure relating to SQL stmnt in cache, SAP security note 1499108

SAP security note 1499108, "Potential info. disclosure relating to SQL stmnt in cache", is a program error note released on 12.04.2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can discover information relating to executed SQL statements from a plan cache dump that was not created by the malicious user.

Solution

The report RSDB4ANALYZE_V5R3_PLANCACHEDMP that is affected by this problem is appropriate in systems only that use the database IBM DB2 for i5/OS with Release V5R3. The report may be removed in later SAP releases that have no longer been certified for this database release.

The Support Package assigned to this note removes the report from SAP releases that are not released for i5/OS V5R3. In lower releases, the report is changed so that the analysis is restricted to a certain file name.

If you are not using the database IBM DB2 for i5/OS with Release V5R3, you can also delete the report RSDB4ANALYZE_V5R3_PLANCACHEDMP manually.

If you use transaction SNOTE to implement this note, the report is changed in all SAP releases so that only a file with a predefined name can be analyzed.

Users that are not database administrators should generally not have the authorization to execute the report.

Reason and prerequisites

Information such as the type, number, and implementation of SQL statements can be discovered using SAP Basis ABAP for DB2 on IBM i or i5/OS. This information may be used by a malicious user to obtain information about all of the SQL statements that are executed in the system and their implementation. However, this information does not contain the results of SQL queries (user data).

References

• SAP Note 1310325 – IBM i: Analysis of the plan cache in V5R3, Component BC-DB-DB4

Affected components

• SAP_BASIS: Versions 620 to 640, 700 to 702, 710 to 730, 72L