In January 2020, SAP released critical security notes addressing vulnerabilities in the Business Object Repository (BOR), clickjacking protections for SAP AS ABAP, and a Denial of Service (DOS) flaw in the Internet Communication Manager (ICM). Organizations are advised to review these patches to secure their SAP environments against unauthorized access and system instability.
Executive Summary
The January 2020 SAP security bulletin introduced vital updates to mitigate three distinct security risks affecting SAP NetWeaver Application Server ABAP and kernel services. The primary update, Note 2822074, addresses a missing authorization check in the Business Object Repository (BOR). By implementing this note and activating the switchable authorization check objects SBORRFC and SBORPRX via transaction SACF, administrators can better secure remote BOR access.
Additionally, SAP re-released Note 2142551, which provides updated instructions for implementing a whitelist-based framework to defend against clickjacking attacks. This framework, detailed further in SAP Note 2319727, replaces standard HTTP response headers that are often insufficient for complex NetWeaver integration scenarios. Finally, a significant kernel patch was issued in Note 2848498 to resolve a Denial of Service vulnerability in the Internet Communication Manager. This flaw allowed attackers to exploit the IIOP or P4 services via buffer overflow, potentially crashing the ICM. Implementing these patches is essential for maintaining the integrity and availability of SAP systems.
Key Takeaways
- Note 2822074 introduces SBORRFC and SBORPRX authorization objects to secure remote access to the Business Object Repository.
- The report SWORFCAUTHCHECKSTATE is used to verify the activation of new BOR authorization checks.
- SAP provides a whitelist-based framework to protect AS ABAP environments against clickjacking attacks.
- Note 2848498 patches a buffer overflow vulnerability in the Internet Communication Manager that could lead to Denial of Service.
- Note 2844646 is a mandatory prerequisite for the implementation of Note 2822074.
Summary of SAP Security Notes
The following table summarizes the key SAP security notes released in January 2020.
| Security Note | Vulnerability Type | Primary Action |
|---|---|---|
| 2822074 | Missing Authorization Check | Activate SBORRFC and SBORPRX |
| 2142551 | Clickjacking | Implement whitelist framework |
| 2848498 | Denial of Service (DOS) | Apply kernel patch |
How do I secure the SAP Business Object Repository?
To secure the Business Object Repository (BOR) in SAP NetWeaver Application Server ABAP, you must implement Note 2822074. This note introduces the switchable authorization check objects SBORRFC and SBORPRX to supplement the generic SRFC authorization. These objects must be activated using transaction SACF. Note that Note 2844646 is a prerequisite and must be implemented first. After application, you can execute the report SWORFCAUTHCHECK_STATE to verify that the checks are properly activated.
How do I protect SAP AS ABAP against clickjacking?
SAP protects AS ABAP against clickjacking through a whitelist-based framework, as detailed in the re-released Note 2142551. Standard measures like the X-Frame-Options HTTP response header are often unsuitable for common NetWeaver integration scenarios, necessitating this specific framework. Implementation details for this whitelist protection are described in SAP Note 2319727.
How do I patch the ICM Denial of Service vulnerability?
The Denial of Service (DOS) vulnerability in the Internet Communication Manager (ICM) is addressed by the kernel patch provided in Note 2848498. This vulnerability allowed attackers to crash the ICM by sending specially crafted packets to the IIOP or P4 service, leading to a buffer overflow. Applying the corrections in this note enables the system to detect and prevent these buffer overflow attempts.
Frequently Asked Questions
What is the purpose of Note 2822074?
Note 2822074 addresses a missing authorization check in the Business Object Repository (BOR) of SAP NetWeaver Application Server ABAP. It introduces new authorization objects (SBORRFC and SBORPRX) to control remote access.
Why is the standard X-Frame-Options header insufficient for clickjacking?
Standard protective measures like the X-Frame-Options HTTP response header are often not suitable for common NetWeaver integration scenarios. SAP therefore provides a specialized whitelist-based framework to manage clickjacking risks effectively.
What services are affected by the ICM buffer overflow vulnerability?
The buffer overflow vulnerability in the Internet Communication Manager (ICM), patched by Note 2848498, specifically affects the IIOP or P4 services. Attackers could exploit these to cause a system crash.