Potential information disclosure relating to usernames, SAP security note 1576763

SAP security note 1576763, "Potential information disclosure relating to usernames", is a program error note released on 13.12.2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can discover information relating to usernames who use SAP Application Server ABAP. This information could be used to allow the malicious user to specialize their attacks against SAP Application Server ABAP.

Solution

Please apply the support package mentioned in this note at least, or the respective correction instruction.

Note that for Releases up to 730 the default for the security change is INACTIVE and must be activated explicitly with the instance profile parameter rdisp/auth_check_user_list = TRUE. Otherwise, the change will behave as before. As of 731, the change is ACTIVE by default and can be DEACTIVATED if needed (not recommended) with the following setting: rdisp/auth_check_user_list = FALSE.

If the change is active, function module TH_USER_LIST can be executed only via RFC from a remote SYSTEM (not instance) if the authorization object S_RZL_ADM with ID ‘ACTVT’ and field ’03’ is granted.

Reason and prerequisites

Information such as the user data can be discovered using SAP Application Server ABAP. This information may be used by a malicious user to further target SAP Application Server ABAP and products built on it.

CVSS

Score 3.5 Vector: AV:N/AC:M/AU:S/C:P/I:N/A:N

Affected components

• SAP_BASIS: 46C, 620-640, 700-702, 710-730, 731, 800-802