SAP security note 1581525, "Update #1 to Security Note 1503856". Below are the symptom and SAP recommended solution.
Description
Symptom
SAP Security Note 1581525 addresses an update to the previously released Security Note 1503856. The update was necessary due to missing Support Package patch level entries in the initial release.
Solution
To resolve the issue, apply the provided patches to the MESSAGING SYSTEM SERVICE 7.20 component. For older Support Packages, the correction is available as a patch. Ensure that software components of the Adapter Engine are updated to the specified patch levels detailed in the "SP Patch Level" section of the note or consider upgrading to newer versions. The archives and the support package stack guide can be accessed on the SAP Service Marketplace as referenced in SAP Note 952402.
Reason and prerequisites
The update was required because the original Security Note 1503856 lacked the necessary Support Package patch level entries, which are crucial for ensuring the security and stability of the affected components.
References
- SAP Note 1503856 – Potential information disclosure relating to server info
- SAP Note 1889488 – Briefing at Black Hat conference on July 31st, 2013
Full note on SAP: SAP Support Launchpad note 1581525
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
