SAP security note 2459319, "Weak encryption used in SAP Netweaver Data Orchestration Engine". Below are the symptom and SAP recommended solution.
Description
Symptom
Weak encryption is used in the code section of FM SMMW_DISC_ENCRYPT, and this function module and the method DISC_DOWNLOAD of class CL_SDOE_DISC_SYNC_HANDLER have not been in use in the system.
Solution
Implement this note to fix the issue. Implementation of the note will comment out the code of both function module SMMW_DISC_ENCRYPT and method DISC_DOWNLOAD of class CL_SDOE_DISC_SYNC_HANDLER.
- For NWAs 710: apply this note if you are using SP19 to SP22, or apply Support Pack 23.
- For NWAs 711: apply this note if you are using SP12 to SP17, or apply Support Pack 18.
- For NWAs 730: apply this note if you are using SP14 to SP17, or apply Support Pack 18.
- For NWAs 731: apply this note if you are using SP01 to SP04, or apply Support Pack 05.
Reason and prerequisites
Weak encryption has been used in FM SMMW_DISC_ENCRYPT to encrypt the data. The key value is hardcoded in the FM, and knowing the key value can allow unauthorized users to decrypt the data. This FM and the calling method have not been used in the system.
You are using NWAs 710 SP19 to SP22, or NWAs 711 SP12 to SP17, or NWAs 730 SP14 to SP17, or NWAs 731 SP01 to SP04.
CVSS
Score 2.7
Full note on SAP: SAP Support Launchpad note 2459319
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
