RSCSAUTH Authorization group ABAP program, SAP security note 694148

SAP security note 694148, “RSCSAUTH: Authorization group ABAP program”, is a program error note released on 08.10.2009. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The RSSCAUTH report, used to change the authorization group of a program, is insufficiently protected against uncontrolled execution. Currently, the system only checks if the user has an authorization (including the “SAP_ALL” value in the “Authorization group ABAP program” field) for the S_PROGRAM authorization object. This weak protection allows a large group of users to execute RSSCAUTH, which can have significant and unintended effects.

Solution

To address the security vulnerability, import the specified Support Package or apply the note correction. This update enhances the security by tightening the conditions under which RSSCAUTH can be executed:

• General Restriction: Only users with at least display authorization for the S_DEVELOP authorization object can execute RSSCAUTH.
• Authorization Checks: If program attributes are changed during execution (not just in test mode), the same authorization checks that apply when making changes directly in the Object Navigator or ABAP Editor are enforced for each program.
• Outcome of Failed Checks: Any unsuccessful authorization check results in an immediate termination of RSSCAUTH, and the authorization group for the program remains unchanged.

Reason and prerequisites

Both note 33154 and the report documentation provide detailed instructions on using RSSCAUTH. The authorization group of a program can also be maintained directly in the ABAP Editor’s “Attributes” dialog box.

References

Affected components

• SAP_BASIS: Versions 46A to 46D, 610 to 640