In this release, 9 security notes have been newly released and 4 have been updated. We will highlight some of the notes below. 

SAP NetWeaver Java

With all the attention on recent cloud developments, on-premise applications may be a bit neglected by organizations. SAP NetWeaver Java is an example of such a technology stack, also because of the future roadmap of Java-based products. This month though, we see 3 security notes that require serious attention.

First things first: the HotNews. Note 3536965 describes not 1 but 3 vulnerabilities that have been discovered in the Adobe Document Services component of SAP NetWeaver Java. Generating PDF files is broadly used of course, and many don’t realize that this is often actually handled by a web service on SAP NetWeaver Java. Even when users are working in another system, like SAP S/4 HANA, the Java system is often used for this. 

Note 3536965 describes how an attacker can exploit a vulnerability to completely compromise the system, hence the CVSS score of 9.1. Two other vulnerabilities are also mentioned in the note that concern Adobe Document Services, but these have a lower impact (CVSS 6.8). All 3 issues are fixed with the same software update, there is no workaround available so applying the patch is necessary here.

Note 3542543 points at another vulnerability on AS Java where a vulnerable servlet can be exploited for Server-Side Request Forgery (SSRF). There is a workaround available that disables the functionality but – as always – it is recommended to apply the provided patch by SAP.

Note 3351041 is about a ‘classic’ vulnerability that is caused by missing validation of XML. Applying the patch is the way to solve this.

SAP Web Dispatcher

Last month, we referred to Note 3520281 which had the highest rating of November (CVSS 8.8). At first glance, it may look as if this note needs to be re-evaluated but only background information is added, and no customer action is required. See FAQ note 3526389 for additional information on this vulnerability.

SAP NetWeaver ABAP / ABAP Platform

Not a month goes by without security notes for the ABAP technology stack. This time, this concerns the following notes:

Note 3469791 describes how an attacker can use Remote Function Calls (RFC) to restricted destinations to expose credentials for further exploitation (CVSS 8.5). The preferred solution is to apply a kernel update for the system involved. But there is a workaround available by setting parameter ‘rfc/dynamic_dest_api_only’ to value 1. Because this parameter value can be set dynamically, this can be a quick solution. Make sure to estimate the impact on other connections though, as described in the note.

Other notes for SAP ABAP are either informational and require no action (Note 3504390) or have a low impact and simply require the software updates to be applied (Note 3536361 and 3522332).

SAP Business Objects

Note 3433545 was released in August earlier this year but the fix mentioned has now become obsolete. For all situations, follow the instructions from note 3515653 instead, even if you have applied the fix of note 3433545 earlier! The 3 vulnerabilities mentioned here, all concern ‘File upload vulnerabilities’. By applying these fixes, the vulnerability from Note 3524933 is fixed at the same time :-).