Security Patch Notification - MaxDB ?

[nelis]

Good day,

I would like to request a sticky thread be made for security announcements regarding MaxDB that we could then "watch" and whenever a vulnerability is discovered those "watching" will be automatically notified.

I recently discovered a Secunia advisory - http://secunia.com/advisories/29312/ leading me to SAP Note 114035 which makes me wonder how a person is supposed to keep track of these things besides being proactive. Unfortunately even being proactive doesn't always help especially when you dealing with several hundred curious Computer Science students like we have at our University.

Perhaps there is such a feature already(MaxDB Security list or otherwise), if so then please point me in the right direction. I realize I could always keep watching the Security lists but that is extremely time consuming and not really a viable solution.

Thanks and regards,

Nelis

[lbreddemann · Accepted solution]

Hi Nelis,

such functionality actually already exists for a very long time.

It's called HOT NEWS.

See [https://service.sap.com/notes] --> SAP HotNews.

In addtion to just monitor the list of HotNews there, it's also possible (and recommended) to setup a subscription so that you get informed about any new Hot News.

From the [SAP HotNews Documentation|http://service.sap.com/~form/sapnet?_SHORTKEY=01100035870000427015&_SCENARIO=01100035870000000202&]:

" Newsletter

In addition, you can receive relevant SAP HotNews and SAP TopNotes by e-mail. In the SAP Service Marketplace, go to My Profile -> Maintain My Subscriptions and Notifications. Select SAP HotNews and SAP TopNotes."

Usually MaxDB security issues are resolved very quickly after development gets to know them. Using the most current versions therefore is a quite good idea if you have the databases exposed to so many abitious hackers

Hope that is what you're looking for.

KR Lars

[nelis · Accepted solution]

Thanks I have defined a filter and subscribed to the relevant newsletters although I still think a MaxDB specific Security Notification would be a good thing.