The December 2020 SAP security update addresses three critical vulnerabilities, including OS command injection in SAP Business Warehouse, missing authentication in SAP NetWeaver AS Java P2P cluster communication, and a privilege escalation flaw in the UDDI server. These updates are essential for maintaining system integrity and preventing unauthorized administrative access.
Executive Summary
The December 2020 SAP security releases provide critical patches for vulnerabilities that could allow attackers to compromise system confidentiality, integrity, and availability. The most severe issues impact SAP Business Warehouse (BW) and SAP NetWeaver Application Server (AS) Java.
For SAP Business Warehouse and BW4HANA, a Hot News note patches an OS command injection vulnerability. Depending on the release version, the fix restricts function module execution to legitimate users or removes the vulnerable function entirely. SAP NetWeaver AS Java also received a critical update to address a missing authentication check in P2P Cluster Communication, which could otherwise be exploited to perform administrative functions like system shutdowns. Additionally, a privilege escalation vulnerability in the UDDI server of AS Java was patched, preventing potential full-system compromise. Administrators are advised to apply these updates immediately and utilize recommended workarounds, such as modifying message server access control lists or adjusting firewall rules, to mitigate risks until patching is complete.
Key Takeaways
- OS Command Injection: A severe vulnerability in SAP Business Warehouse and BW4HANA was addressed in note 2983367.
- P2P Authentication: SAP NetWeaver AS Java P2P cluster communication was patched via note 2974774 to prevent unauthorized administrative actions.
- UDDI Server Escalation: A critical privilege escalation flaw in the AS Java UDDI server was resolved in note 2979062.
- Mitigation Strategies: Administrators can use firewall rules or message server access control lists as temporary workarounds for P2P cluster vulnerabilities.
What vulnerabilities were addressed in the December 2020 SAP Security Notes?
The December 2020 updates addressed three primary security vulnerabilities across SAP Business Warehouse and SAP NetWeaver AS Java platforms. These vulnerabilities involved OS command injection, missing authentication checks, and privilege escalation.
| Vulnerability Type | Affected SAP Component | SAP Note |
|---|---|---|
| OS Command Injection | SAP Business Warehouse / BW4HANA | 2983367 |
| Missing Authentication | SAP NetWeaver AS Java (P2P Cluster) | 2974774 |
| Privilege Escalation | SAP NetWeaver AS Java (UDDI Server) | 2979062 |
How can I mitigate the P2P Cluster Communication vulnerability?
The missing authentication check in P2P Cluster Communication can be mitigated by restricting network access to the P2P port. Administrators should modify the message server access control list to permit P2P connections only from trusted IP addresses. Additionally, network firewall rules can be configured to block all external access to the P2P port, preventing unauthorized connections from outside the cluster.
FAQ
What is the impact of the UDDI server vulnerability?
The privilege escalation vulnerability in the UDDI server of AS Java can be exploited to completely compromise the confidentiality, integrity, and availability of the server OS. This is considered a critical security risk.
How does the patch for SAP Business Warehouse OS command injection work?
For release 7.30, the patch binds the execution of the affected function module to a hard-coded report and legitimate users. For release 7.40 and higher, the vulnerable function is removed entirely.
Where can I find the official SAP security notes?
The official notes are available via the SAP Support Launchpad. You can access the specific notes mentioned here using the links provided: 2983367, 2974774, and 2979062.