Potential information disclosure relating to NW Application Server and BW, SAP security note 2121869

SAP security note 2121869, "Potential information disclosure relating to NW Application Server and BW". Below are the symptom and SAP recommended solution.

Description

Symptom

An attacker can discover information relating to NW Application Server and BW who uses BW-BEX-ET. This information could be used to allow the attacker to specialize their attacks against NW Application Server and BW and BW-BEX-ET.

Solution

Frontend part: implement the below-mentioned frontend patch.

• SAP NetWeaver 7.0 BW Front End for GUI 730: import Front-End Patch (FEP) 801 (or higher) for SAP NetWeaver 7.x BW Front End (bi730sp8_801-10004472.exe) into your system. The FEP will be available as soon as SAP Note 2116488 with the short text "SAPBWNews NW 7.x BW Add-On Frontend Patch 801 – GUI 7.30", which describes this FEP in more detail, is released for customers. This SAP Note might already be available before the FEP is released. You can check the planned availability dates in SAP Note 1085218.
• SAP NetWeaver 7.0 BW Front End for GUI 740: import Front-End Patch (FEP) 101 (or higher) for SAP NetWeaver 7.x BW Front End (bi740sp1_101-10004472.exe) into your system. The FEP will be available as soon as SAP Note 2116489 with the short text "SAPBWNews NW 7.x BW Add-On Frontend Patch 101 – GUI 7.40", which describes this FEP in more detail, is released for customers. This SAP Note might already be available before the FEP is released. You can check the planned availability dates in SAP Note 1085218.

Backend part: implement the below-mentioned support package or this note via transaction code SNOTE.

• SAP NetWeaver BW 7.00: import Support Package 34 for SAP NetWeaver BW 7.00 (SAPKW70034) into your BW system. The Support Package will be available as soon as SAP Note 1930843 with the short text "SAPBWNews NW BW 7.0 ABAP SP34", which describes this Support Package in more detail, is released for customers.
• SAP NetWeaver BW 7.01 (SAP NW BW7.0 EHP 1): import Support Package 17 for SAP NetWeaver BW 7.01 (SAPKW70117) into your BW system. The Support Package will be available as soon as SAP Note 2013377 with the short text "SAPBINews NW7.01 BW ABAP SP17", which describes this Support Package in more detail, is released for customers.
• SAP NetWeaver BW 7.02 (SAP NW BW7.0 EHP 2): import Support Package 17 for SAP NetWeaver BW 7.02 (SAPKW70217) into your BW system. The Support Package will be available as soon as SAP Note 2017437 with the short text "Preliminary Version SAPBWNews NW BW 7.02 ABAP SP17", which describes this Support Package in more detail, is released for customers.
• SAP NetWeaver BW 7.11: import Support Package 14 for SAP NetWeaver BW 7.11 (SAPKW71114) into your BW system. The Support Package will be available as soon as SAP Note 1940531 with the short text "Preliminary Version SAPBINews NW7.11 BW ABAP SP14", which describes this Support Package in more detail, is released for customers.
• SAP NetWeaver BW 7.30: import Support Package 13 for SAP NetWeaver BW 7.30 (SAPKW73013) into your BW system. The Support Package will be available as soon as SAP Note 2021667 with the short text "SAPBWNews NW7.30 BW ABAP SP13", which describes this Support Package in more detail, is released for customers.
• SAP NetWeaver BW 7.31 (SAP NW BW 7.3 EnhP 1): import Support Package 14 for SAP NetWeaver BW 7.31 (SAPKW73114) into your BW system. The Support Package will be available as soon as SAP Note 2030844 with the short text "Preliminary Version SAPBWNews NW BW 7.31/7.03 ABAP SP14", which describes this Support Package in more detail, is released for customers.
• SAP NetWeaver BW 7.40: import Support Package 9 for SAP NetWeaver BW 7.40 (SAPKW74009) into your BW system. The Support Package will be available as soon as SAP Note 2030800 with the short text "Preliminary Version SAPBWNews NW BW 7.4 ABAP SP09", which describes this Support Package in more detail, is released for customers.

In urgent cases, you can use the correction instructions. Before you use the correction instructions, make sure that you check SAP Note 1668882 for transaction SNOTE. This SAP Note might already be available before the Support Package is released. In this case, however, the short text still contains the term "preliminary version".

GUI part: hotfix 1 for SAP GUI for Windows 7.40 PL1 (gui740_01_1.exe); please see SAP Note 2096517.

Expected delivery dates of SAP GUI for Windows patches: if the patch which contains the correction from this note is not yet delivered, you can check SAP Note 1053737 for the expected delivery date. Additionally, you can subscribe to the corresponding thread in the SAP Developer Network to receive a notification whenever a SAP GUI for Windows patch is delivered.

Downloading SAP GUI patches: all SAP GUI patches are available on SAP Service Marketplace. Detailed information about the location of the patches can be taken from SAP Note 563161. SAP Note 330793 explains how to download patches from SAP Service Marketplace.

Installation of SAP GUI for Windows patches: the installation of SAP GUI for Windows patches is documented in the SAP GUI Installation Guide. SAP Note 535308 also contains information on how to apply these patches.

Reason and prerequisites

Information such as the installed products, versions of those products, landscape configuration data, and user passwords can be discovered using BW-BEX-ET. This information may be used by an attacker to further target NW Application Server and BW.

CVSS

Score 5.0 Vector: AV:N/AC:L/AU:N/C:P/I:N/A:N