SAP security note 1577886, "Update #2 to Security Note 1534608". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Attempting to create the authorization object J_IAC_PP in SAP_BASIS Release 7.00 (Support Package 23 or higher) results in an error due to non-conformance with naming standards.
Solution
- Import the Transport: Download the transport file
SUSO_J_IAC_PP_Transport.zip. Unpack the ZIP file and place the contents in the relevant transport directory of your SAP system. Import the transport to implement the authorization objectJ_IAC_PP. - Implement Security Note 1534608: After importing the transport, proceed to implement security note 1534608 as per your standard procedure. Ensure that the transport is also applied to all systems where you transport the SNOTE correction.
Reason and prerequisites
This issue occurs in customer systems running SAP_BASIS Release 7.00 with Support Package 23 or higher. Manual creation of the authorization object without the necessary transport can lead to the observed error.
References
- 1909442 – Incorrect authorization check in IAC post processing
- 1567038 – Update #1 to Security Note 1534608
- 1534608 – Missing authorization check in IAC postprocessing
Affected components
- IS-M from version 464 to 605
Full note on SAP: SAP Support Launchpad note 1577886
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
