Live Chat....

[former_member183818]

Live Chat in SCN will be great...rite...

Do you agree?

[psr2412]

No Plz.

WR,

PS R

[Former Member]

This message was moderated.

[Former Member]

Yes .. i am very keen to remove out your doubts through discussion. Great step towards solution.

[Former Member]

This message was moderated.

[JL23]

What do you think was the intention of the FAQ author to make a part of this sentence bold:

• You'll need an S User ID to login to SAP Service Marketplace: these are issued to SAP customers and partners only.

What do you want to do with bug fixes if you are not a customer?

Last week somebody posted he had bought a S-user ID from someone for 100 $ , there seems to be a black marked somewhere. I have a S-user so I had never the need to check where we can buy S-user IDs (along with passwords of course).

[Former Member]

Not at all , Jurgen . I'm just now learning sap module . I don't have such intention to use that intellectual property for malicious function . ..

in SCN's different , question - answer thread , somebody stated that consult with *** OSS note / or refer to OSS note no. ****

I just want to know , apart from entering into SAP service marketplace , there is any other alternative way to explore OSS note ??

Because , I'm a simple learner . I don't have that kind relationship as partner / customer with SAP . So , without it , impossible to achieve a S-id .

that's why I'm asking about any other alternative way .

[JL23]

What sense would it make to lock something behind a door and then having a backdoor that everyone can walk in?

If SAP protects their notes from public access and requires an extra user id and password, then they would not launch those documents somewhere else to be seen by anybody.

Makes sense?

But copyright violations can be found everywhere.

[Former Member]

It is also very important to have version control. Notes are versioned, become obsolete, have subsequent related notes, etc.

They also contain a lot of industry and proprietary information about SAP solutions and services (and problems...).

@ Patel: If you enrole for an official SAP Education Training at SAP, then you get your S-account to display SAP notes with it if you did not have one already (at least it used to be like that and that is how I got my S-account). If you buy your SAP system on a CD disk at a market and get your auntie to explain the customizing and ABAP to you, then you do not have access to SAP notes. Life is hard but fair...  🙂

Cheers,

Julius

[Former Member]

SAP=Ghetto----Not getting along with security folks... Other vendors post vulnerabilites and links to fixes. 

[Former Member]

Yep, thinking that you are anonymous in the internet brings out the worst in folks.

SAP also posts links to fixes - but you must logon in most cases. In isolated cases they lift the notes further to SCN for access from here. For example "knowledge base" documents.

Also security researchers who responsibly report errors have access to the corresponding notes. Actually we get the solutions in advance mostly to test them.

But just hanging around to pass on SAP notes as security advisories is a waste of everyone's time.

Cheers,

Julius

[Former Member]

The vulnerability is available to all CVE-2014-5055. Why not give out version of SAP Crystal report? Everyone else does...it  is not a waste of time (2-5 seconds that it would take)

[Former Member]

I agree with you sentimentally, it would be great. But SAP software does not have an install shield. There is also no option in the GUI to "check for updates" with regards to such things.

Even the clients developed by SAP are generally engineered by the customer to meet their requirements. The user should not be able to apply software changes.

That means a lot of testing normally, and a lot of time.

Within the SAP software domain, the industry standard of 90 days grace period for real admins when responsibly reporting vulnerabilities is not realistic for most of the customers, even although the turn around for 0-day hacks is down to single digit hours. In SAP it has probably been known and used for years, they just did not see the problem with it so the changes need to be done carefully.

For example, it is often amusing to see the reaction of folks that you can administrate the database from the application. The same client even as the end users are using to order their pens and pencils and sell products, just different authorizations for a different program within the application.

Anyway, to cut a long story short, without a valid S-account you cannot access SAP notes. SO you need a valid reason to have an S-account. You need to do that - not difficult and necessary.

Cheers,

Julius

[Former Member]

I must not be understanding..A vulenrabiltiy has been reported (CVE-2014-5055). Simply stated --> Is in on SAP Crystal Reports 2008 V0 or V1, SAP Crystal Reports 2011. We currently are running licensed and purchased SAP Crystal Reports 2008 V1 on over 100 systems and need to know if our version is vulnerable.   How do I get an S-account, if that is what is needed to get this simple bit of information to protect our highly secure environment?

[JL23]

go to your IT department, most probably the Basis folks is responsible to setup users at the SAP market place. Ask them politely to give you access. Maybe you have a formal procedure in your company where you need a (digital) signature by your supervisor before you can get access. But it is certainly something you have to tackle in-house. You can't blame SAP for not knowing how access is given to users in your company

[Former Member]

Me thinks that if you have a highly secure SAP landscape but no access to S-Account, then you are not authorized to implement the server side correction.

A customer basis admin will have access to the correction source and instructions in the SAP note. They will also know what the dependencies are and be able to judge the priority and testing requirements.

Subscription services to advisories without access to SAP notes and no understanding of SAP is not good for customers and system stability.

Cheers,

Julius

[Former Member]

therfore,  Everyone's (microsoft.oracle,google,etc) methods of reporting vulnerabilities should be disregarded and they should all follow you......Were talking about providing informative alerts.. not access to patches and downloads.

[Former Member]

Yes, if you can see that there is an alert on the SOLMAN Security ConfigVal, then evaluate it. That comes from SAP and can be accessed.

If someone creates their own spam list of advisories, then in the SAP context they should as a minimum requirement have access to SAP Notes. Otherwise it is just noise and incorrectly advises customers.

How come you dont have an S-account?

Cheers,

Julius

[Former Member]

That would be nice, I'd really love to use a chat application in SCN

[former_member183818]

Yea that true Amarpreet. I think LIVE chat should be there only for selected forums, not for all. In COffee Corner LIVE chat will make it more lively.

[Lukas_Weigelt]

Would be fun, I agree on that. But concidering the site's slowness overall (already without such a feature)... I'm unsure whether this would bode well...

[former_member183818]

Agree with you

[Amarpreet]

It's a great idea .. But think of it this way- if we had a live chat on scn ... Everybody with a problem would go there to ask for solutions - which would be great and easy, But the solution never gets documented, that is why forums are great they kind of document them selves 🙂

[Former Member]

Amarpreet i am totally agreed with you from Documentation point of view but in case some one need urgent help then Live Chat is an wonderful Option.

[ThomasZloch]

Software problems (in the standard, not with urjent requirements) should be reported ASAP via SMP to receive help at the earliest. Once your issue is taken seriously by the other end, it almost feels like live chat, sometimes they even call you back on the phone, usually while you are away for lunch or cigarette ("customer not reached").

In the discussion spaces, everybody's issues enjoy the identical priority, "ASAP" etc.  should be <removed by moderator>.

I don't see a need for live chat on SCN.

Thomas

[Former Member]

So far I am not impressed with SAP customer service. http://service.sap.com/sap/support/notes/1999142

I am attmepting to access this URL (SAP) and login dialog box appears whic does not accept my credentials. HELP??

[JL23]

Are you sure you doing better there than here?

I  mean, what has your question with this old discussion from 2012 to do?

Maybe you are using your SCN ID to get into the Service Market Place, and do not even have any credentials to access OSS notes ?

see:

[former_member184878]

Hello,

Just tried your link.

Log on prompt and fine with SID + PW

ask your admin.

br erwin

[Former Member]

??? I use credentials created during registration process with SAP... Is there something different??

Does it boil down to having to pay for something???

[Former Member]

Nothing to do with old discussion....SAP discussion board is not User friendly??? Just simply trying to gather information about new vulnerability in Crystal reports. Quite difficult... unlike other vendors which are a piece of cake---microsoft,oracle,cisco,google,etc.....

[former_member184878]

Hello,

For places like:

Marketplace

Partner Edge

you need an S ID.

Registration at SCN is something different.

br erwin

[Former Member]

How do I get SID

[former_member184878]

Hello,

Plese read above.

has mentioned, and follow link, information is presented properly,

No training material on these places.....

S ID: SAP certification, working in SAP Consulting company,

br erwin

[Former Member]

There are often a fleet of security scene parasites who regurgitate the SAP notes as security advisories which they sell to customers. When the customer however asks for a rating or opinion on whether it is remote exploit or only applicable to a certain version, then the regurgitators have no access to SMP to get the information beyond that which they simply passed on.

Actually as far as I am concerned you can give them access because they would not understand it anyway... but officially this information is for the person who reported the problem and for customers and partners who need to be equipped with information to fix the problem.

Bystanders, back-seat-drivers and football commentators are not intended in this process. They just get in the way.

If you want to see the official enhanced service for this information, then I can recommend SAP note 1839420. That and the Security Config Validation in Solution Manager will help you further. A bogus security advisory subscription with no clue about SAP will not help you.

Cheers,

Julius