The May 2020 SAP Security Notes address critical vulnerabilities, including code injection in Service Data Download, authentication bypass in SAP Business Intelligence Platform, and security flaws in SAP Adaptive Server Enterprise. These patches are essential for preventing server compromise and protecting sensitive system data across SAP environments.
Executive Summary
The May 2020 release from SAP includes several high-priority security patches addressing vulnerabilities that could lead to unauthorized code execution, authentication bypass, and information disclosure. The most critical update, SAP Security Note 2835979, resolves a code injection vulnerability in the Service Data Download feature, which carries a CVSS score of 9.9/10 and could allow attackers to compromise ABAP servers. Additionally, SAP Business Intelligence Platform users are urged to address an authentication bypass issue in Live Data Connect, detailed in Note 2885244. Finally, critical flaws in SAP Adaptive Server Enterprise (ASE) are addressed in Notes 2917275 and 2917090, protecting against malicious code execution and the exposure of sensitive credentials. Organizations running affected versions of these SAP platforms should prioritize these updates to mitigate significant security risks.
Key Takeaways
- SAP Note 2835979 patches a critical code injection vulnerability in Service Data Download with a 9.9/10 CVSS score.
- Authentication bypass in SAP Business Intelligence Platform (Note 2885244) requires an upgrade to version 2.4 of Live Data Connect.
- SAP Adaptive Server Enterprise (ASE) versions 16.0 SP02 and SP03 are impacted by critical code injection and information disclosure vulnerabilities.
- Applying these patches prevents potential system compromise and unauthorized access to sensitive account credentials.
What are the critical vulnerabilities in SAP NetWeaver?
The most critical vulnerability for SAP NetWeaver is a code injection flaw in the Service Data Download feature, addressed by SAP Security Note 2835979. This vulnerability allows an attacker to inject malicious code into the ST-PI plugin for the NetWeaver Application Server ABAP (AS ABAP). With a CVSS score of 9.9/10, this flaw can be exploited over the network, potentially leading to a complete compromise of the ABAP server.
How do I secure SAP Business Intelligence Platform?
To secure the SAP Business Intelligence Platform against authentication bypass, administrators must apply the fix provided in SAP Security Note 2885244. This update enables Live Data Connect to log on to the BI Central Management Server (CMS) using a shared key, preventing unauthorized access without a password. This fix is specifically available for version 2.4 of Live Data Connect; customers on earlier versions must upgrade to version 2.4 to be protected.
What security updates are available for SAP Adaptive Server Enterprise?
SAP Adaptive Server Enterprise (ASE) requires updates for critical code injection and information disclosure vulnerabilities covered by SAP Security Notes 2917275 and 2917090.
- Note 2917275 introduces input validation checks for DUMP and LOAD commands to block malicious code execution.
- Note 2917090 secures sensitive system data and user account credentials against unauthorized disclosure.
These notes apply to ASE versions 16.0 SP02 and SP03.
Vulnerability Summary Table
The following table summarizes the key SAP security notes from May 2020.
| SAP Note | Platform/Component | Vulnerability Type | CVSS Score |
|---|---|---|---|
| 2835979 | NetWeaver AS ABAP | Code Injection | 9.9/10 |
| 2885244 | SAP BI Platform | Authentication Bypass | 9.8/10 |
| 2917275 | SAP ASE | Code Injection | Not Stated |
| 2917090 | SAP ASE | Information Disclosure | Not Stated |
Frequently Asked Questions
Which SAP platforms are affected by the May 2020 security notes?
The affected platforms include SAP NetWeaver Application Server ABAP, SAP Business Intelligence Platform, and SAP Adaptive Server Enterprise (ASE).
What is the risk of the vulnerability found in SAP NetWeaver?
The vulnerability in SAP NetWeaver allows for code injection, which can be exploited over the network to gain complete control over ABAP servers, posing a critical risk to the entire system.
What should I do if I am running an older version of Live Data Connect?
If you are running a version of Live Data Connect earlier than 2.4, you are advised to upgrade to version 2.4 to apply the necessary security fixes for the authentication bypass vulnerability.