SAP Security Note
High priority
SAP security note 1567038, "Update #1 to Security Note 1534608", is a program error note released on 14.06.2011. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Even though Note 1534608 has been implemented, certain functions of Internet Application Component (IAC) postprocessing can be called by a user who is logged on, even if this user does not have the required authorizations.
Solution
To ensure that certain functions of IAC postprocessing cannot be called despite the implementation of Note 1534608, use the Note Assistant to implement this note.
Reason and prerequisites
Note 1534608 is insufficient.
References
Affected components
- IS-M 464
- IS-M 471
- IS-M 472
- IS-M 600
- IS-M 602
- IS-M 603
- IS-M 604
- IS-M 605
Full note on SAP: SAP Support Launchpad note 1567038
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
