SAP Security Note
High priority
SAP security note 1526853, "Protection of upgrade tools against acts of sabotage", is a program error note released on 21.10.2014. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
If you execute upgrade tools directly in test mode, a malicious user can use a clever selection of input parameters to overwrite or delete system-relevant data or files.
Solution
Note: If you have already used SUM Version SP05 or above in your system, you can ignore this SAP Note, because all affected objects have either been deleted or adapted accordingly.
- Set the table maintenance parameter for the table TICNV to 'Display/Maintenance Allowed with Restrictions'.
- Safeguard the execution of programs and function modules appropriately, or implement the attached corrections. After implementing the corrections, execution is permitted only for the system-wide user DDIC. Ensure adequate access restrictions exist for this user.
- Always implement this SAP Note again after executing the "Extraction" step or the "Import" step of an upgrade or an Enhancement Package installation (EHPI application), or after a support package import using SAPup, EHPI, or SUM.
The corrections are valid for all releases equally, including releases prior to 46A. Individual objects may cause warnings or errors during automatic implementation: if an object does not exist in the system, the error can be ignored; if the object exists but the source code deviates from the correction instructions, use the split-screen editor of the Note Assistant to insert the new source code lines appropriately.
Reason and prerequisites
Upgrade tools are structured in such a way that they can be called by standalone C programs (SAPup, SAPehpi). Therefore, many programs and function modules have input parameters that control the behavior of the tools dynamically, in order to accommodate the numerous scenarios involved in an upgrade or an Enhancement Package installation.
References
This note refers to
Referenced by
- SAP Note 3474726 – Central Note – Software Update Manager 2.0 SP22 [lmt_022]
- SAP Note 3429205 – Central Note – Software Update Manager 2.0 SP21 [lmt_021]
- SAP Note 3412485 – Central Note – Software Update Manager 1.1 SP04 [lmt_007]
- SAP Note 3334353 – Central Note – Software Update Manager 1.1 SP03 [lmt_006]
- SAP Note 2882395 – Central Note – Software Update Manager 1.0 SP26 [lmt_004]
Affected components
- SAP_APPL 31I
- SAP_APPL 40A to 40B
- SAP_APPL 45A to 45B
- SAP_BASIS 46A to 46D
- SAP_BASIS 610 to 640
- SAP_BASIS 700 to 702
- SAP_BASIS 710 to 730
Full note on SAP: SAP Support Launchpad note 1526853
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].