Security Note for Security Audit Log, SAP security note 1878371

SAP security note 1878371, "Security Audit Log Vulnerability", is a note released on 08.04.2014. Below are the symptom and SAP recommended solution.

Description

Symptom

BC-SEC-SAL contains code that permits the execution of a dedicated program code that allows the user to delete an important file.

Solution

Apply the relevant kernel patch as specified in the Support Package Patches section below.

Review the following additional protection measures:

• Review the information provided in SAP Note 177702. This note describes how to further protect your files by assigning authorizations to access operating system files using ABAP commands.
• In general, files of the Security Audit Log must not be read by ABAP commands. Protect them by assigning the appropriate S_DATASET authorizations to your users and by using S_PATH protection as described in Note 177702.
• Use a dedicated folder for Security Audit Log files. Enter this directory into the SPTH table and enable the flags FS_NOWRITE and FS_NOREAD, thus disabling any read or write access from ABAP to this directory.
• Configure the Security Audit Log (parameter DIR_AUDIT) to use this directory.

Reason and prerequisites

The system contains a possibility to execute a special kernel function in an unintended way. The code is protected by an ABAP function and the kernel call authorization object, only. A developer with the authorization to code arbitrary programs and with the authorization for this kernel function can call the function in his program and harm the system.

• A valid and authenticated user is required.
• The user needs at least authorization for S_DEVELOP and S_C_FUNCT.
• The authorization object S_C_FUNCT is not checked when the kernel parameter auth/system_access_check_off is set.
• With these authorizations, the user can delete data.

CVSS

Score 4.1 Vector: AV:L/AC:M/AU:S/C:P/I:P/A:P