SAP Security Note
High priority
SAP security note 1557426, “Update #1 to Security Note 1536291”, is a program error note released on 16.02.2011. Below are the symptom and SAP recommended solution.
Description
Security note 1536291 that eliminates the vulnerability of an unauthorized execution of functions in CRM EP specifies an incorrect Support Package patch level.
Symptom
The solution is available in CRM Release 7.01 as of Support Package 003 patch level 1.
The specified patch level 0 for Support Package 001 of CRM Release 7.01 (BP CRM FOUNDATION CODING 7.01, Support Package 001, patch level 0) is incorrect.
Solution
For a correction of CRM Release 7.01, apply patch level 1 of Support Package 003 (BP CRM FOUNDATION CODING 7.01 Support Package 003, patch level 1) of the software component CRMFND.
Reason and prerequisites
The incorrect patch level information must be removed from security note 1536291.
References
Full note on SAP: SAP Support Launchpad note 1557426
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
