November 2020 saw critical SAP security patches addressing code injection, remote execution, and privilege escalation vulnerabilities. Key notes include 2973735, 2982840, 2985866, 2890213, and 2979062, which remediate severe flaws across SAP AS ABAP, S/4 HANA, Data Services, Solution Manager, and NetWeaver.
The November 2020 SAP security updates focused on high-severity vulnerabilities that could allow attackers to compromise system integrity and execute unauthorized commands. The most significant issue, patched in note 2973735, involved a code injection vulnerability in SAP AS ABAP and S/4 HANA that required a new authorization check on object SDMIS. SAP Data Services also received critical updates via note 2982840 to address remote code execution and denial of service risks. Furthermore, authentication bypasses in SAP Solution Manager’s LM-SERVICE and a privilege escalation vulnerability in the SAP NetWeaver Java stack were addressed to prevent OS-level compromise. These patches highlight the ongoing necessity of monitoring SAP Security Notes to maintain environment security.
Key Takeaways
- Note 2973735 patches a code injection vulnerability in SAP AS ABAP and S/4 HANA.
- Critical vulnerabilities in SAP Data Services, including remote execution, are addressed in note 2982840.
- Notes 2985866 and 2890213 fix authentication issues in SAP Solution Manager.
- Note 2979062 resolves a privilege escalation flaw in the SAP NetWeaver Java stack.
What is the code injection vulnerability in SAP AS ABAP and S/4 HANA?
The code injection vulnerability in SAP AS ABAP and S/4 HANA is patched by note 2973735, which introduces an authorization check for object SDMIS. This check controls the execution of a vulnerable function module used for checking the syntax of table selection queries. Attackers could previously abuse this function module to inject malicious ABAP code, potentially leading to a complete system compromise.
What critical issues affect SAP Data Services?
Note 2982840 addresses multiple critical vulnerabilities in SAP Data Services, including risks related to remote execution and denial of service. These vulnerabilities require immediate attention to prevent unauthorized control or disruption of the service.
How do the updates address SAP Solution Manager vulnerabilities?
Hot News notes 2985866 and 2890213 address security gaps in the Java stack of SAP Solution Manager. Specifically, these notes remove missing authentication checks within the LM-SERVICE, closing the vulnerability that could otherwise be exploited.
What is the risk of the SAP NetWeaver Java stack vulnerability?
The privilege escalation vulnerability in the UDDI Server of SAP NetWeaver Application Server for Java, addressed by note 2979062, poses a significant security risk. If exploited, an attacker could execute arbitrary OS commands, potentially leading to a full compromise of the underlying operating system.
Frequently Asked Questions
What does note 2973735 fix?
Note 2973735 patches a code injection vulnerability in SAP AS ABAP and S/4 HANA by introducing an authorization check for object SDMIS to control the execution of a vulnerable function module.
Are there critical patches for SAP Data Services?
Yes, note 2982840 addresses multiple critical vulnerabilities in SAP Data Services, including remote execution and denial of service risks.
Which notes address authentication in SAP Solution Manager?
Notes 2985866 and 2890213 address security gaps by removing missing authentication checks in the LM-SERVICE within the Java stack of SAP Solution Manager.