Layer Seven Security ADVISORY

Transcription

1 Layer Seven Security ADVISORY SAP Security Notes July 01

2 In July, SAP released a crucial update for a vulnerability in the Archiving Workbench originally patched in February 011. Note contains instructions for an automated correction using the Note Assistant through transaction SNOTE and overrides the manual instructions provided in the earlier Note The Archiving Workbench uses archiving objects to move mass amounts of online data to offline or nearline storage systems. Each SAP document type is archived through a unique archiving object. Financial Accounting documents, for example, are archived using the archiving object FI_DOCUMNT which includes the document header, company code-dependent postings, change documents, and other elements. In another example, user, authorization and profile changes are archived through the objects US_USER, US_AUTH and US_PROF. The Workbench includes an Archive Development Kit (ADK), which provides the runtime environment for archiving, and a Monitor to review scheduled and completed archiving jobs. SAP Security Notes July 01 Archiving is controlled through the S_ARCHIVE authorization object. ADK performs a check for this object when a user calls a function module in the Archiving Workbench. The object can be configured to provide read, write, move or delete permissions. Activity level 01 provides all permissions, while 0 only allows users to display archive files and view settings in the archive management console. Required permission levels should be defined in the individual function modules. Notes and are designed to patch missing authorization checks in certain modules. As a result, users that should have restrictive permissions may be able to escalate their privileges and move or even delete archived data. This could potentially lead to data loss, corruption or theft.

3 SAP Security Notes by Vulnerability Type Customers that have recently upgraded or are planning to upgrade from NetWeaver (NW) 004 or 7.0 to NW PI 7.10 or NW 7. should read SAP Note very closely. This deals with an alarming vulnerability in the secure store area of the SAP JEE Engine. The secure store area is used to store sensitive data such as passwords in encrypted form. By default, the JEE Engine stores sensitive data in the file \usr\sap \<SID>\SYS\global\security\data \SecStore.properties. This file is created during installation and includes the SAP<SID>DB and Administrator passwords. The former is used for database connectivity and the latter for system administration. The contents of the secure store file are encrypted with a triple DES algorithm using the SAP Java Cryptology Toolkit. There should be a prompt to change the default key phrase used to generate the encryption key during the upgrade procedure. However, this prompt is not displayed if the upgrade is performed with the SAPJup tool with a patch level lower than PL 54. As result, some upgraded systems may still have the default key phrase set on the secure store. Customers that have migrated to SAP s new and much vaulted HANA database, should take a look a Note This patches a memory corruption exploit that could be used by remote, malicious users to crash database operations and provoke a Denial of Service.

4 SQL Statements can bypass authorization checks 4 Finally, all customers should review Note which updates newer releases of JEE applications for a SQL injection vulnerability originally patched in March. Open or native SQL statements can bypass authorization checks. Therefore, modified strings in SQL statements can lead to unauthorized access to information stored in database tables. Note applies input validation to counter a vulnerability in the XML Data Archiving Service (XML DAS) that allows malicious users to retrieve or modify restricted data from databases by modifying strings in SQL statements generated by the program.

5 Appendix: SAP Security Notes, July 01 PRIORITY NOTE AREA DESCRIPTION CA-GTF-TS-GMA Update to Security Note BC-BSP Update 1 to security note BC-XI-IBD Update to Security Note BC-UPG-TLS-TLA Directory traversal in function module STATUS_EXP from SDBM SV-SMB-AIO-PFW-SB Unauthorized modification of displayed content in BP-SOLBLD SV-SMG-SDD Missing authorization check in ST-PI BC-SRV-PMI Untrusted XML input parsing possible in PMI BC-XI-CON-AFW Untrusted XML input parsing possible in XI Adapter Framework BC-UPG-TLS-TLJ SAP Java Upgrade: change the default secure store key phrase BC-DB-HDB Security issues fixed in SAP HANA Revision 8 and later BC-FES-ITS ITS: XSS vulnerability on page generated by HTTP handler CRM-BF-CFG Unauthorized modification of displayed content in CRM IPC BC-FES-ITS ITS: Replace HTML encoding by new ABAP function CRM-ISA Unauthorized modification of stored content in CRM-ISA PA-GE Unauthorized modification of stored content in PA-GE EP-KM-COL Missing authorization check in EP-KM-COL component BC-ABA-LA Missing authorization check in ABAP Dump Collector CRM-ISA-BBS Missing authorization check in CRM-ISA-BBS FS-AM-ARC FS-AM-ARC/Archiving: Potential disclosure of persisted data JEE-APPS Update # to security note BC-CTS-LAN Code injection vulnerability in BC-CTS-LAN PPM-PRO Missing authorization check in PPM-PRO EP-KM-WD Potential information disclosure relating to server info BC-JAS-SEC-UME Unauthorized use of User Mapping functions in portal

6 Layer Seven Security Layer Seven Security specialize in SAP security. We serve customers worldwide to protect information assets against internal and external threats and comply with industry and statutory reporting requirements. The company fuses technical expertise with business acumen to deliver unparalleled audit, consulting and vulnerability assessment solutions targeted at managing risks associated with contemporary SAP systems. Our consultants have an average of ten years of experience in field of SAP security and proficiency in regulatory compliance including Basel II, GLBA, HIPAA, FISMA, PIPEDA, PCI DSS and SOX. The company is privately owned and headquartered in Toronto, Canada. Address Westbury Corporate Centre Suite Upper Middle Road Oakville, Ontario L6H 0C, Canada Web Telephone

7 Copyright Layer Seven Security 01 - All rights reserved. No portion of this document may be reproduced in whole or in part without the prior written permission of Layer Seven Security. Layer Seven Security offers no specific guarantee regarding the accuracy or completeness of the information presented, but the professional staff of Layer Seven Security makes every reasonable effort to present the most reliable information available to it and to meet or exceed any applicable industry standards. This publication contains references to the products of SAP AG. SAP, R/, xapps, xapp, SAP NetWeaver, Duet, PartnerEdge, ByDesign, SAP Business ByDesign, and other SAP products and services mentioned herein are trademarks or registered trademarks of SAP AG in Germany and in several other countries all over the world. Business Objects and the Business Objects logo, BusinessObjects, Crystal Reports, Crystal Decisions, Web Intelligence, Xcelsius and other Business Objects products and services mentioned herein are trademarks or registered trademarks of Business Objects in the United States and/or other countries. SAP AG is neither the author nor the publisher of this publication and is not responsible for its content, and SAP Group shall not be liable for errors or omissions with respect to the materials.