Security problems due to dynamic SQL, SAP security note 1421432

SAP security note 1421432, "Security problems due to dynamic SQL", is a program error note released on 11.05.2010. Below are the symptom and SAP recommended solution.

Description

Symptom

In the class CL_SALV_WD_TEST_DATA (which is used by various Web Dynpro test applications), the system dynamically accesses any database tables in the method SELECT_DATA_FROM_DDIC without a check. This is a potential security risk.

Solution

Implement the relevant correction instructions or import the relevant Support Package.

• SAP NetWeaver 7.00: Import Basis Support Package 22.
• SAP NetWeaver 7.01: Import Basis Support Package 7.
• SAP NetWeaver 7.02: Import Basis Support Package 3.
• SAP NetWeaver 7.10: Import Basis Support Package 10.
• SAP NetWeaver 7.11: Import Basis Support Package 5.
• SAP NetWeaver 7.20: Import Basis Support Package 3.

Exception: Certain applications, for example, SRM 6.0 Support Package 02 (Note 1048612), require a specific SAP NetWeaver Support Package. You must check for these prerequisites before importing the specified SAP NetWeaver Support Package.

There is now a check to verify whether the transferred name is the name of an individual database and whether the user has permission to view data from this table.

Reason and prerequisites

This problem is caused by a program error.