SAP security note 1433243, "Potential information disclosure relating to passwords", is a note released on 13.12.2011. Below are the symptom and SAP recommended solution.
Description
Symptom
A malicious user can discover information relating to passwords being used to deliver SAP PI Runtime Workbench. This information could be used to allow the malicious user to specialize their attacks against passwords and SAP PI Runtime Workbench.
Solution
A fix for the described security issue is delivered with the new Support Packages and Patch Levels of the following Software Components:
- XI ADAPTER FRAMEWORK (SAP_XIAF)
- XI TOOLS (SAPXITOOL)
- MESSAGING SYSTEM SERVICE (MESSAGING)
Please update the software components to the patch levels maintained in the "SP Patch Level" section of this note or use newer versions. The archives and the support package stack guide can be found on the SAP Service Marketplace as described in SAP Note 952402.
Full note on SAP: SAP Support Launchpad note 1433243
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].