In this release, 8 security notes have been newly released and 2 have been updated. Interestingly, none of these have the highest priority ‘HotNews’. Let’s look at some highlights below.

Non-critical components?

When securing an SAP landscape, it is logical to first focus on the main applications. This makes sense because that’s where most of the work is done and where the data is stored and processed. Many security notes concern these main applications, like the various modules of SAP S/4 HANA, ECC etc. From a security perspective though, it is vital to realize that many other tools, agents etc., exist in a landscape that can be exploited if these are not properly maintained! It is easy to overlook these components and that’s why we give these a bit more attention in this month’s blog.

SAP Web Dispatcher

We have written about the SAP Web Dispatcher many times before, but it still is a component that can be easily overlooked. Normal end users certainly won’t realize it is there. Technical administrators should know about it of course. But in more complex landscape architectures, even seasoned technical administrators require good insight to identify connectivity flows and the role that Web Dispatcher installations play. A Web Dispatcher can also run in different modes, that is: as a standalone installation or as an embedded process within an ABAP or Java system. That may make insight even more complicated.

Security note 3520281 has the highest CVSS rating this month (8.8) and describes how a Cross-Site Scripting vulnerability (XSS) can be used to fully compromise the underlying system. Interestingly, this only concerns situations where users logon to the Web Dispatchers UI with the ‘admin’ role. The note describes various workarounds but it is of course highly recommended to apply the released patches!

Security note 3508947 describes how the use of SAP GUI for HTML can lead to access to files that should be restricted. Although the patch itself is for the SAP ABAP backend, this vulnerability is only relevant when proxy servers are used, like an SAP Web Dispatcher (or another proxy server). This is a clear example of how security concerns more than only the main component.

SAP Host agent

The next example regards the SAP Host agent, a component that is probably only known by technical administrators. A rather small component that is installed out-of-the-box together with the installation of many SAP products and that is used for ‘life-cycle’ tasks, mainly monitoring. Security note 3509619 describes how this agent can be used to manipulate system files with great potential impact.

SAP Software Update Manager (SUM)

The Software Update Manager (SUM) is a tool that is used for tasks like the installation and upgrade of components in an SAP landscape. It is – again – a tool that is mainly known and used by technical administrators. Security note 3522953 describes how the SUM can write credentials (username / password combinations) unencrypted to log files on the OS level, allowing unauthorized access to the system.

The above are just a sub-set of examples based on this month’s release. Each month we see security notes like these that concern components that are beyond the ‘standard’ scope of the main technology stacks. Be aware!

The other notes we have not yet mentioned concern mainly the ‘standard’ corrections for applying patches to the relevant component. For the complete overview, see below.