Skip links
Arpine Maghakyan

Arpine Maghakyan

Security Researcher of RedRays.

Security note Delete the file usagetypes.properties, SAP security note 1324901

Description

After you have successfully completed the installation using SAPinst, the file usagetype.properties remains in the system. This file should exist only temporarily for the time period in which the CTC is called by SAPinst without dialogs. After you have completed this installation step, the file is no longer required.

This file is used to exchange information, such as the logon data of all of the user IDs that were created or changed by the installer. The passwords are subject to only a very weak encryption in the file. This was appropriate and sufficient for a very short existence. However, if the file remains on the computer for a longer period of time, it is a security problem if the passwords were not changed again after the installation.

Available fix and Supported packages

  • SAP_BASIS | 700 | 701

Affected component

    BC-INS
    Installation Tools (SAP Note 1669327)

CVSS

Score: 0

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected].

URL

https://launchpad.support.sap.com/#/notes/1324901

TAGS

#

More to explorer

SAP Security For All

RedRays Security Platform for Penetration testers and Bug hunters

The product package is specifically created for cyber security experts who have encountered SAP while participating in bug bounty programs.

RedRays Security Platform for SAP Consultants

The product package is designed for SAP consultants conducting security assessments of SAP ERP systems. We provide essential tools and resources to help professionals in this field conduct their work effectively.

RedRays Security Platform for Enterprises

The product package is specifically optimized to cater to the needs of both small/medium and large companies who are seeking to streamline the process of organizing a comprehensive security system for ERP systems.