Security check when executing external commands/programs (2), SAP security note 866732

SAP security note 866732, “Security check when executing external commands/programs (2)”, is a program error note released on 08.10.2009. Below are the symptom and SAP recommended solution.

Description

Symptom

The security measures described in Note 686765 for external commands and external programs are insufficient for you.

Solution

You can use the sapxpg patches described in this note to have the system interpret the file sapxpg.sec (refer to Note 686765) as a positive list.

To implement this:

• Assign a three-character value, such as POS, to the environment variable SAPXPG_SEC_CHECK on the target host.
• Do not use the character ‘/’ as a separator in the sapxpg.sec file; instead, use the character #.

Examples for the sapxpg.sec file:

• #U#*#C#*#T#3#F#*#O#cp, pwd, ls #S#*#
  Only the commands cp, pwd, and ls may be executed by all users with the SAP authorization for external commands or external programs.
• #U#SMITH#C#*#T#3#F#*#O#cp, pwd, ls #S#*#
#U#CARTER#C#*#T#3#F#*#O#cp, pwd, ls, rm #S#*#
#U#SUPERUSER#C#*#T#3#F#*#O#*#S#*#
  In this example, the user SUPERUSER can execute all commands.

Available Patches:

• Release 640 sapxpg patch 7
• Release 700 sapxpg Patch 1

In later kernel releases, these functions will be part of the standard release.

For operating systems UNIX and Windows NT, you can replace the program sapxpg, Kernel Release 4.6D or 620 with sapxpg, Release 640.