SAP Security Note
High priority
SAP security note 1495099, "Replacing dynamic open SQL statements", was released on December 14, 2010. Below are the symptom and SAP recommended solution.
Description
Symptom
In certain classes of the SAP List Viewer, the system uses dynamic SQL statements unnecessarily. This does not represent an immediate security risk because the way in which the dynamic SQL statements are built cannot be affected by inputs and only a fixed number of instances are possible.
Solution
The dynamic SQL statements are replaced by static SQL statements.
- SAP NetWeaver 7.02: Import Basis Support Package 5. (Support Package SAPKB70205)
- SAP NetWeaver 7.30: Import Basis Support Package 1. (Support Package SAPKB73001)
In urgent cases, you can implement the correction instructions as an advance correction. (Correction Instructions)
Full note on SAP: SAP Support Launchpad note 1495099
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].