Security note Additional checks in dscdb6up, SAP security note 1158618

SAP security note 1158618, "Security note: Additional checks in dscdb6up", is a program error note released on 08.10.2009. Below are the symptom and SAP recommended solution.

Description

Symptom

Members of the sapsys group can damage files of other users on UNIX by using the program dscdb6up incorrectly.

Solution

Use a current version of the program dscdb6up to prevent intentional system damage. Patch text: "DB6: additional security checks".

To avoid the problem, proceed as follows:

• If unsure about the current version of dscdb6up, remove the SUID bit: chmod 750 dscdb6up. Without the SUID bit, dscdb6up cannot change any operating system passwords.
• Change the passwords using operating system means.
• Recreate the password file using: dbscdb6up -create…

Reason and prerequisites

The program dscdb6up belongs to the group sapsys and has an SUID bit (chown root:sapsys ; chmod 4750), allowing users to change their operating system passwords, which connect them to the SAP database. Members of the sapsys group can exploit a gap in C-coding to overwrite other users’ files with the content of the password file.