RE-Classic Potential Directory Traversal, SAP security note 1509424

SAP security note 1509424, "RE-Classic Potential Directory Traversal". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Potential Directory Traversal in the following components:

• RE-BD
• RE-RT

Solution

The mentioned programs are used in RE-Classic for legacy data transfer. As RE-Classic is an old product (see also note 443311) for which the successor product RE-FX exists, we decided to remove the critical coding inside the programs contained in the correction instructions. After implementing the correction, the programs do not work anymore. If you use these programs nevertheless, please submit a customer message under subject area RE-BD or RE-RT with reference to this note.

Reason and prerequisites

• The programs contained in the correction instructions contain vulnerabilities through which a malicious user can potentially read arbitrary files on the remote server, possibly disclosing confidential information.
• The programs contained in the correction instructions contain a vulnerability through which a malicious user can potentially write arbitrary files on the remote server, possibly corrupting data or altering system behavior.

References

• SAP Note 1599072 – Directory traversal in RE-BD
• SAP Note 1574302 – Directory traversal in RE-BD and RE-RT
• SAP Note 1497003 – Potential directory traversals in applications

Affected components

• SAP_APPL 40B
• SAP_APPL 45B
• SAP_APPL 46B
• SAP_APPL 46C
• SAP_APPL 470
• SAP_APPL 500
• SAP_APPL 600
• SAP_APPL 602
• SAP_APPL 603
• SAP_APPL 604
• SAP_APPL 605