SAP Security Note
SAP security note 1555144, “Potential information disclosure relating to file system”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can discover information relating to the file system structure. This information could be used to allow the malicious user to specialize their attacks against BC-UPG.
Solution
Apply the correction instructions in all affected systems. If you use SAPup, SAPehpi, or SUM, re-apply the corrections after the respective roadmap steps:
- SAPup: Roadmap step ‘Extraction’
- SAPehpi: Roadmap step ‘Extraction’
- SUM: PREPARE module ‘Import’
If the objects in the correction instructions do not exist, you can ignore them. If there are issues while applying the correction instructions, consider deleting the complete coding of the affected function modules.
CVSS
Score 3.5 Vector: AV:N/AC:M/AU:S/C:P/I:N/A:N
References
Referenced by
- Function Module SUBST_GET_FILE_LIST changed after Upgrade (1686357)
- Central Note – Software Update Manager 2.0 SP22 (3474726)
- Central Note – Software Update Manager 2.0 SP21 (3429205)
- Central Note – Software Update Manager 1.1 SP04 (3412485)
- Central Note – Software Update Manager 1.1 SP03 (3334353)
- Central Note – Software Update Manager 1.0 SP26 (2882395)
Affected components
- SAP_APPL – Versions 31I to 31I, 40A to 40B, 45A to 45B
- SAP_BASIS – Versions 46A to 46D, 610 to 640, 700 to 702, 710 to 730
Full note on SAP: SAP Support Launchpad note 1555144
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].