Hot News Note 2622660 delivers critical Chromium 70.0.3538 security fixes for the browser controls in SAP Business Client, and Note 2681280 patches a critical remote code execution flaw in SAP HANA Streaming Analytics (CVSS 9.9/10). Note 2701410 fixes a directory traversal in SAP Disclosure Management, and Note 2693083 removes a privilege escalation transaction.
Executive Summary
The November 2018 SAP Security Notes include Hot News Note 2622660, updated for multiple high-risk Chromium vulnerabilities in SAP Business Client, and Note 2681280, a critical remote code execution fix for SAP HANA Streaming Analytics. Note 2701410 (SAP Disclosure Management) and Note 2693083 (CRM Records and Case Management) address a directory traversal and a privilege escalation risk.
Key Takeaways
- Hot News Note 2622660 was updated for multiple high-risk vulnerabilities addressed by Chromium release 70.0.3538 in SAP Business Client.
- Microsoft delivers fixes for the Internet Explorer browser control directly; SAP delivers Chromium fixes for Chrome through periodic Security Notes.
- Note 2681280 patches a critical remote code execution vulnerability in SAP HANA Streaming Analytics, with a CVSS score of 9.9/10.
- Note 2701410 fixes a high-risk directory traversal vulnerability in SAP Disclosure Management.
- Note 2693083 removes transaction ZPTTNO_TIME from role SAP_PS_RM_PRO_RECMANAGER to stop privilege escalation in CRM Records and Case Management.
What does Hot News Note 2622660 fix in SAP Business Client?
Hot News Note 2622660 includes critical security updates for web browser controls delivered with SAP Business Client. The Client provides a unified environment for SAP applications including Fiori, SAP GUI, and Web Dynpro. It supports browser controls from Internet Explorer (IE) and Chrome for displaying HTML content. Security corrections for the WebBrowser control of the .NET framework in IE are delivered directly by Microsoft. Unlike IE, the browser control for Chrome is embedded in SAP Business Client using the open source Chromium Embedded Framework (CEF). Security fixes are provided by the Chromium project and delivered by SAP through periodic Security Notes. Note 2622660 was updated for multiple high-risk vulnerabilities addressed by Chromium release 70.0.3538.
What does Note 2681280 fix in SAP HANA Streaming Analytics?
Note 2681280 patches a critical remote code execution vulnerability in SAP HANA Streaming Analytics (HSA). The vulnerability impacts the open source Java-based Spring Framework library used by HSA. The note carries a CVSS score of 9.9/10.
Which other notes were released in November 2018?
Note 2701410 deals with a high-risk directory traversal vulnerability that could be exploited by attackers to access, modify or corrupt files on hosts supporting SAP Disclosure Management. Note 2693083 removes transaction ZPTTNO_TIME from the standard role SAP_PS_RM_PRO_RECMANAGER. The transaction could be abused to escalate privileges in CRM Records and Case Management.
| Note | Product | Issue |
|---|---|---|
| 2622660 | SAP Business Client | Multiple high-risk Chromium 70.0.3538 vulnerabilities |
| 2681280 | SAP HANA Streaming Analytics | Critical remote code execution (CVSS 9.9/10) |
| 2701410 | SAP Disclosure Management | High-risk directory traversal |
| 2693083 | CRM Records and Case Management | Privilege escalation via transaction ZPTTNO_TIME |
Frequently Asked Questions
What does Hot News Note 2622660 address?
It delivers critical security updates for the web browser controls in SAP Business Client, and was updated for multiple high-risk vulnerabilities addressed by Chromium release 70.0.3538.
Who delivers security fixes for the browser controls in SAP Business Client?
Microsoft delivers corrections for the Internet Explorer WebBrowser control directly. Chromium project fixes for the Chrome control are delivered by SAP through periodic Security Notes.
What does Note 2681280 patch?
It patches a critical remote code execution vulnerability in SAP HANA Streaming Analytics, caused by the Spring Framework library, with a CVSS score of 9.9/10.
What does Note 2693083 change?
It removes transaction ZPTTNO_TIME from the standard role SAP_PS_RM_PRO_RECMANAGER, because the transaction could be abused to escalate privileges in CRM Records and Case Management.