SAP Security Notes – February 2022

On the 8th of February 2022, SAP Security Patch Day saw the release of 13 new Security Notes.

1 security note was released out-of-band.

Further, there were 5 updates to previously released Patch Day Security Notes.

Notes by severity

Highlights

February Patch Day meets us with a variation of Notes qualified as “HotNews” with a CVSS Score of 10.

Let’s take a look at 3123396 SAP Security Note with such Score, Request smuggling and request concatenation in SAP NetWeaver, the first in the list to go. As it is said, a significant amount of services like SAP NetWeaver ABAP and JAVA AppServer along with ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable to request smuggling and request concatenation. To mitigate the possibility of request prependation of the victim’s arbitrary data by an attacker, SAP strongly recommends patching all SAP Kernel and SAP Web Dispatcher components.
Further update list contains Security Notes numbered 3130920, 3142773 and 3139893 dedicated to Remote Code Execution vulnerability, associated with Apache Log4j 2 components with CVSS Score of 10 each. The following products as SAP Commerce, SAP Data Intelligence 3 and SAP Dynamic Authorization Management became more secure with help of security and version patches, the list of recommendations for Remote Code Execution vulnerability mitigation for different products and mitigation steps for the Control Center and Policy Controller servers are included. We also recommend taking a glance at the presented workarounds by SAP.

Then we can see a separate group of Security Notes dedicated to updating the Remote Code Execution vulnerability of Apache Log4j 2. All of them have a CVSS Score of 10 too. Workaround for 3132922 SAP Note was shortened and 3154684 Note was added to the 3131047 Note “Solution” list with the February update. The list of updates of previously released SAP Notes also contains standard Security updates for the browser control Google Chromium delivered with SAP Business Client SAP Security Note 2626260 first released in April 2018.

To configure the missing segregation of duties described in SAP Security Note 3140940, it is recommended to apply the latest LM_SERVICE version containing the fix described in informational SAP Note 3145008 along with SAP Note 3137764 to remove the links to the applications from the SAP Solution Manager Launchpad. The CVSS Score of 9.1 is still critical.

In the configuration details of the Virus Scanner Interface in 3112928 Security Note with the CVSS Score of 8.7 was changed in comparison to January for Multiple vulnerabilities in F0743 Create Single Payment application of SAP S/4HANA.

Lastly, it would be good to pay attention to the highly prioritised 3140587 Security Note with a CVSS Score of 8.1, which describes SQL Injection vulnerability in SAP NetWeaver AS ABAP. The correction changes the SQL statement with a dynamic WHERE clause into a SQL statement with a static WHERE clause. For the 3123427 Security Note (CVSS Score of 7.1) dedicated to HTTP Request Smuggling in SAP NetWeaver Application Server Java, it is said that those vulnerabilities have been fixed by proper memory handling for HTTP pipeline requests.

Summary