SAP Note 888889 - Automatic checks for security notes using RSECNOTE

Symptom

The SAP EarlyWatch Alert report contains selected checks about "Security". Among other things, there is a check to determine whether or not selected and required security-relevant notes or HotNews have been implemented in the system. The report displays an overall status.  An administrator uses the tool RSECNOTE to create the detailed evaluation of the required security-relevant notes in the system to be analyzed.

This note responds to the following situations:

• In the SAP EarlyWatch Alert report, the "Service Preparation Check" unit complains that Note 888889 is not implemented.  As a result, the check for security-relevant notes can only be carried out partially in the "Security" section.

• You want to use the tool RSECNOTE to check the implementation status of security-relevant notes in your system.  However, this tool is not yet available in your system.

• You require detailed information on implementing and executing the tool RSECNOTE, and on interpreting the results.

• You call transaction ST13.  In the F4 help for the "Tool Name" field, the entry RSECNOTE is missing.  If you manually enter RSECNOTE and then execute it, the system issues the message "The tool RSECNOTE does not exist".

• The tool RTCCTOOL shows that the tool RSECNOTE is missing.

Other terms
EarlyWatch Alert, EWA, security, RSECNOTE, RTCCTOOL, ST13


Reason and Prerequisites
The tool RSECNOTE is part of the software component ST-A/PI as of Release 01M_*. Correction instructions are available for the installation in Release 01L_*.

As of Support Package 3 for the Service Content Plug-In ST-SER 701_2008_2, various services in the Solution Manager require the tool RSECNOTE on the managed system to check whether or not security-relevant notes are implemented.

The service report shows that this tool is missing and makes reference to this present Note 888889.


Solution
Below you will find:
- a guide to implementing the tool RSECNOTE
- documentation on using the tool and information about the background and further procedures

Guide for creating the tool RSECNOTE

1. Install the tool RSECNOTE in all systems in which you want to use the tool. SAP recommends that you install Release 01M_* of the software component ST-A/PI. See Note 69455 for more information.
You can also install the tool RSECNOTE in Release 01L_* by implementing the correction instructions using transaction SNOTE. Go to "System Change Option" in transaction SE06 and set the software component ST-A/PI and the namespaces/name ranges "General SAP Name Range", /SSA/, and /SSF/ to "Modifiable".  Enter /SSA/RTC if you are asked to specify a main program for /SSA/INT.

2. Assign the following authorizations to all the users for whom you want to provide access to the tool.

Object	Field	Value
S_TCODE	TCD	ST13
S_ADMI_FCD	S_ADMI_FCD	ST0R
S_PTCH_ADM	TABLE	' (or empty)
	COMPONENT	SECURITY-CHECK
	ACTVT	02 (change)

Documentation for the tool RSECNOTE

You use transaction ST13 to start the tool RSECNOTE.  In transaction ST13, select the tool and start it by choosing "Execute" or F8.
Comment: As of SAP_BASIS Release 620 Support Package 55, SAP_BASIS Release 640 Support Package 13, SAP_BASIS Release 700 and subsequent releases, you can also start the tool as the report RSECNOTE by using transaction SA38, for example.

As a result of the tool RSECNOTE, notes that contain security corrections and notes that are relevant for your system due to the existing software components (taking the releases and the Support Packages into account) are displayed.

The report shows the following three sections:

• "Missing recommendations"
  This section shows the required security-relevant SAP Notes and HotNews.
  HotNews are flagged with a red traffic light and notes are flagged with a yellow traffic light.

• "Manually confirmed recommendations"
  Report messages can also be confirmed manually.  This should only happen in exceptional cases that require it.
  For example: You cannot implement a specific note using transaction SNOTE because you manually changed the affected program beforehand.  In this case, implement the corrections manually and confirm the message.

• "Successfully implemented recommendations"
  This section shows the security-relevant notes and HotNews that are required for the system and that are implemented successfully.
  A note or a HotNews is no longer required if your system release or Support Package level already contains the correction. After the system is upgraded or Support Packages are imported, a note that was implemented earlier may no longer be listed.

List of security-relevant notes that are checked
The tool RSECNOTE checks security-relevant notes or HotNews that are entered as related notes in this present note.

For Note 1298433 "Security note: Bypassing security in reginfo & secinfo", however, the system checks only that at least the required kernel patch is installed. It does not check whether the gateway has also been safeguarded.

An overview of other security-relevant notes or HotNews is provided on the SAP Service Marketplace under the quick link /SECURITYNOTES (https://service.sap.com/securitynotes).


Updating recommendations
The quantity of checked notes or HotNews is managed online by SAP. During a check, a system loads the list automatically using the service connection to SAPNet once a day. You can also use the tool RSECNOTE to update the list manually (menu path:  List -> Refresh from SAPNet).

If the system to be checked does not have an online connection to SAPNet, then you can also use a transport to import the current recommendations from another system that has a connection to SAPNet. To do this, create a "Transport of Copies" and enter the object key R3TR TABU /SSF/PTAB. Enter ND* as the table key. This means that all recommendations are selected, including the recommendations for the tools RTCCTOOL and RSECNOTE. Make sure that you have specified a table key. Start the tool RTCCTOOL or RSECNOTE before you export the transport request, to update the recommendations.

Attached to this note is the file
Transport_Files_<date>.zip, which contains the recommendations for the tool RSECNOTE for the specified date. Use the transport files contained in it if you do not have any systems that have an online connection to SAPNet.


EarlyWatch Alert report

The SAP EarlyWatch Alert report also provides a summary of the results of the tool RSECNOTE.  For further information on the SAP EarlyWatch Alert report, see Note 863362.


Note Assistant

You can use the Note Assistant (transaction SNOTE) to implement the correction instructions. You can find additional information about the Note Assistant on SAP Service Marketplace under the quick link /NOTE-ASSISTANT (https://service.sap.com/note-assistant).

Affected Releases

Software Component Release From Release To Release And subsequent ST-A/PI BASIS_46B 01L_BCO46B 01M_BCO46B   ST-A/PI BASIS_46C 01L_BCO46C 01M_BCO46C   ST-A/PI BASIS_46D 01L_BCO46D 01M_BCO46D   ST-A/PI BASIS_610 01L_BCO610 01M_BCO610   ST-A/PI BASIS_620 01L_BCO620 01M_BCO620   ST-A/PI BASIS_640 01L_BCO640 01M_BCO640   ST-A/PI R3_40B 01L_R3_40B 01M_R3_40B   ST-A/PI R3_45B 01L_R3_45B 01M_R3_45B   ST-A/PI R3_46B 01L_R3_46B 01M_R3_46B   ST-A/PI R3_46C 01L_R3_46C 01M_R3_46C   ST-A/PI R3_470 01L_R3_470 01M_R3_470   ST-A/PI APO_30A 01L_APO30A 01M_APO30A   ST-A/PI APO_310 01L_APO310 01M_APO310   ST-A/PI SCM_400 01L_SCM400 01M_SCM400   ST-A/PI BBPCRM_300 01L_CRM300 01M_CRM300   ST-A/PI BBPCRM_315 01L_CRM315 01M_CRM315   ST-A/PI BBPCRM_400 01L_CRM400 01M_CRM400   ST-A/PI SCM_410 01L_SCM410 01M_SCM410   ST-A/PI ECC_500 01L_ECC500 01M_ECC500   ST-A/PI BASIS_700 01L_BCO700 01M_BCO700   ST-A/PI ECC_600 01L_ECC600 01M_ECC600   ST-A/PI SCM_570 01L_SCM570 01M_SCM570   ST-A/PI BASIS_710 01L_BCO710 01M_BCO710   ST-A/PI CRM_570 01L_CRM570 01M_CRM570   ST-A/PI BASIS_720 01M_BCO720 01M_BCO720

Corrections Instructions

Correction Instruction Valid from Valid to Software Component Last Modifcation 768388 01L_APO30A 01L_SCM570 ST-A/PI 18.05.2009  07:50:22 769761 01L_BCO620 01L_SCM570 ST-A/PI 18.05.2009  07:42:54