As said, there are 20 security notes in this month’s release. 17 new notes and 3 updates to existing notes.

See below for the highlights per priority and the end of this post for a complete overview. 

HotNews

The ‘HotNews’ security notes have the highest priority, so let’s look at these first. In previous months, there weren’t any ‘HotNews’ security notes but now there are 3:

Attention for customers that use SAP Landscape Transformation and have installed the DMIS add-on! Without applying the patch from note 3587115, arbitrary ABAP code can be injected into the system which means the system can be completely compromised! No wonder this has CVSS 9.9… It is essential to identify all systems that have the DMIS add-on installed and apply the patch asap. There is no workaround. One up-side is that besides the implementation of the note, there is no further action needed, like restarts, etc. See FAQ note 3588720 for further information. Note that SAP Landscape Transformation can be setup in different scenarios so the add-on can be present on standalone and on source systems.

Next is a similar issue, described in note 3581961 but here it concerns the S/4HANA core component! Again, this is about arbitrary ABAP code injection with the same potential impact: a full system compromise! And again, this is a CVSS 9.9 score. Make sure to implement this note asap on all relevant S/4HANA systems: there is no workaround.

For customers who use the SBOP Financial Consolidation solution, it is essential to apply the patch as described in note 3572688. The system can be seriously compromised, and details are limited but apparently, this concerns some hard-coded authentication details (username/password/key). This kind of coding is an absolute no-go as this note clearly demonstrates…

High priority 

The next stop is the ‘High’ priority notes. These may be a bit lower in priority, but still describe serious security issues.

Note 3554667 describes a vulnerability where a Remote Function Call (RFC) can be crafted to potentially retrieve stored credentials. Depending on the credentials found, this could fully compromise the related service. The solution is to apply a kernel patch but a workaround is available via (dynamically switchable!) parameter rfc/dynamic_dest_api_only.  A rather unknown parameter that controls the behavior of dynamic destinations via API class CL_DYNAMIC_DESTINATION. This CAN be used but thorough testing is required. It is advised though to apply the kernel patch.

Several security notes do not concern ‘direct’ vulnerabilities in code or components from SAP but libraries or other 3rd software used. Note 3590984 is again such an example for SAP Commerce Cloud. The SAP software itself is claimed to have no vulnerability in this respect but the used Apache Tomcat version does. Good to know that the default setup should not be vulnerable but patching is required!

Medium and low-priority

Going further we find a series of notes with priority ‘medium’ and one with priority ‘low’. These mainly concern the plain implementation of the software patch or are about minor (textual) changes. Let this not be a reason to take these notes lightly. Careful assessment remains necessary!

SecurityBridge findings

At SecurityBridge we do not only deliver a complete SAP Security solution for our customers. We also research several SAP Security topics. From this, we regularly discover vulnerabilities ourselves which we address in close cooperation with SAP. Like last month, we are proud to again note that 2 vulnerabilities come directly from these research efforts: note 3577131  and 3571093.