The October 2020 SAP Security Notes address several critical vulnerabilities, including an OS command injection flaw in CA Introscope Enterprise Manager. Security teams should prioritize patching SAP Solution Manager and SAP Focused Run environments, alongside addressing identified issues in SAP NetWeaver and the SAP Business Objects Business Intelligence Platform.
Executive Summary
The October 2020 release of SAP Security Notes provides essential patches for multiple high-risk vulnerabilities across the SAP ecosystem. The most urgent update addresses a critical OS command injection vulnerability in CA Introscope Enterprise Manager (EM), which is utilized by SAP Solution Manager and SAP Focused Run for Java application performance monitoring. Organizations running these services must apply the provided patch for EM 10.7 and 10.5 SP2 patch 2, or upgrade to version 10.5.2.113. If immediate patching is not possible, the service can be stopped without impacting the Cybersecurity Extension for SAP Solution Manager.
Beyond the CA Introscope issue, the release includes critical fixes for SAP NetWeaver and SAP Business Objects. These updates address vulnerabilities ranging from missing XML validation—which could allow unauthorized OS file access and denial of service—to reflected cross-site scripting (XSS) in the SAP NetWeaver Composite Application Framework. Additionally, important updates were issued for missing authentication checks in SAP NetWeaver AS JAVA and information disclosure risks within the SAP Business Objects Business Intelligence Platform. Security administrators should review these notes to ensure proper mitigation of potential exploitation vectors.
Key Takeaways
- Apply patches for CA Introscope EM 10.7 and 10.5 SP2 patch 2 to resolve a critical OS command injection vulnerability.
- SAP NetWeaver requires updates to fix a missing XML validation flaw that enables unauthorized OS file reading and denial of service.
- A reflected cross-site scripting vulnerability in the SAP NetWeaver Composite Application Framework has been patched.
- Important security updates address missing authentication in SAP NetWeaver AS JAVA and information disclosure in SAP Business Objects Business Intelligence Platform.
Which SAP vulnerabilities were addressed in October 2020?
The October 2020 security release addressed several vulnerabilities across various SAP platforms, summarized in the table below.
| SAP Note | Platform / Component | Security Issue |
|---|---|---|
| 2969828 | CA Introscope Enterprise Manager | OS Command Injection |
| 2969457 | SAP NetWeaver | Missing XML Validation |
| 2972661 | SAP NetWeaver Composite Application Framework | Reflected Cross-Site Scripting |
| 2941315 | SAP NetWeaver AS JAVA | Missing Authentication Check |
| 2898077 | SAP Business Objects Business Intelligence Platform | Information Disclosure |
How do you mitigate the CA Introscope Enterprise Manager vulnerability?
To mitigate the OS command injection vulnerability in CA Introscope Enterprise Manager (EM), you must apply the patch for EM 10.7 and 10.5 SP2 patch 2. If your system is on an earlier version, you must first upgrade to version 10.5.2.113 before applying the patch. If you cannot apply the patch immediately, the EM service can be stopped, as it is not required for the Cybersecurity Extension for SAP Solution Manager.
What risks are associated with the missing XML Validation in SAP NetWeaver?
The missing XML validation in SAP NetWeaver, addressed in note 2969457, can be exploited to read arbitrary OS files. Furthermore, this vulnerability can be leveraged by attackers to provoke a denial of service on the affected system.
Frequently Asked Questions
What is the most critical vulnerability in the October 2020 SAP Security Notes?
The most critical issue is the OS command injection vulnerability in CA Introscope Enterprise Manager (EM) (2969828), which affects SAP Solution Manager and SAP Focused Run.
Does stopping the CA Introscope EM service affect other security tools?
No. Stopping the CA Introscope EM service to mitigate the vulnerability will not impact the Cybersecurity Extension for SAP Solution Manager, as the service is not required by the extension.
What kind of vulnerability was found in the SAP NetWeaver Composite Application Framework?
The SAP NetWeaver Composite Application Framework was found to have a high-priority reflected cross-site scripting vulnerability, which was patched in note 2972661.