[152] in SAPr3-news
Security "hole" when copying ABAP's w/INCLUDEs
daemon@ATHENA.MIT.EDU (Michael Nelson)
Wed May 10 20:07:36 1995
To: sapr3-news@MIT.EDU
Date: 10 May 1995 17:57:36 GMT
From: menelson@ix.netcom.com (Michael Nelson)
I've just run across what seems to be a rather significant security
issue:
Using SE38 to copy an ABAP with INCLUDES (example: SAPMF05A).
After you've indicated the target name, you're prompted for which
component objects you wish to copy. Select INCLUDES, then CONTINUE.
You'll get a popup with a list of includes, giving you an opportunity
to change the target names of all the INCLUDES. Do not change the
target names. Next you're prompted to assign transport attributes for
your target ABAP ... select $TMP. Result: The "parent" ABAP is copied
correctly; however, the INCLUDES now have TADIR entries indicating SAP
as the original system, YOU AS THE OWNER, and $TMP as the development
class. So, the delivered INCLUDES of SAPMF05A can now be modified
without having been marked for repair.
Has anyone else run across this? Has it been resolved, how?
Thanks.
Mike Nelson
menelson@ix.netcom.com
