Security note Delete the file usagetypes.properties, SAP security note 1324901

SAP security note 1324901, "Security Note: Delete the file usagetypes.properties", is a program error note released on October 8, 2009. Below are the symptom, SAP recommended solution, reason and prerequisites and the affected software components.

Description

Symptom

After successfully completing the installation using SAPinst, the file usagetype.properties remains in the system. This file should only exist temporarily during the period when the CTC is called by SAPinst without dialogs. Once this installation step is completed, the file is no longer required.

The file is used to exchange information, such as the logon data of all user IDs created or changed by the installer. The passwords in the file are subject to very weak encryption, appropriate only for the short existence of the file. If the file remains on the computer longer, it poses a security risk if passwords are not changed after installation.

Solution

For UNIX Systems: Navigate to the directory: /usr/sap/<SAPSID>/config

For Windows Systems: Navigate to the directory: <Drive>:\usr\sap\<SAPSID>\config

Delete the file usagetypes.properties.

Reason and prerequisites

• A J2EE or ABAP system of Version 7.00 or 7.01 was installed in the past.
• Lower system versions (e.g., 6.40) are not affected as there is no CTC, hence no communication between SAPinst and CTC, and the file does not exist.
• Newer system versions (e.g., 7.10 or higher) are not affected because configuration tasks are migrated from the installer to the CTC, eliminating the file.
• Versions 7.02 and higher have automated the manual solution described here.

Affected components

• SAP_BASIS 700 to 701