Security Note Correction Web Application Server, SAP security note 915084

SAP security note 915084, "Security Note: Correction Web Application Server", is a special development note released on 08.10.2009. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Security information regarding a vulnerability for certain types of invalid or manipulated response messages.

Solution

Insert the following code in class CL_HTTP_SERVER_NET, method RECEIVE_REQUEST:

* bg: 04/04/2001: response protocol should be request protocol
  m_protocol_version =
      request->get_header_field( '~server_protocol' ). "#EC NOTEXT
  if m_protocol_version is not initial.
      if m_protocol_version <> 'HTTP/1.0' and
         m_protocol_version <> 'HTTP/1.1'.
         message e000(sr) with 'Wrong Format'.
      endif.
      response->set_header_field( name = '~server_protocol'
                                 value = m_protocol_version ). "#EC NOTEXT

Reason and prerequisites

This note describes a workaround solution for the solution provided in note 908147. The workaround can be implemented in ABAP as a modification until the kernel patch with the proper correction can be applied. The modification should then be removed from the system.

With "error," we mean a response message causing an error within the SAP Web Application Server.

Drawbacks of the Workaround:

• An error page is displayed differently formatted than the common UI and exposes that this is an SAP Web Application Server.
• The workaround only helps in the ICF channel.
• Side-effects: Rejection of URLs that worked correctly before cannot be excluded, making it more restrictive in case of an error.

CVSS

Score 0

References

Affected components

• SAP_BASIS 620 to 640
• SAP_BASIS 700