SAP system does not start after applying SAP kernel patch

Note 1375494 - SAP system does not start after applying SAP kernel patch

Summary

Symptom

Due to severe security issues with the Microsoft ATL, Windows Server customers always need to apply a runtime fix mentioned in the following Microsoft Knowledge Base Article:

Microsoft Security Bulletin MS09-035 - Moderate Vulnerabilities in Visual Studio Active Template Library Could Allow Remote Code Execution (969706)

You might encounter one of the following situations after applying a new SAP kernel patch:

• Your SAP system fails to start after applying a new SAP kernel patch that you downloaded from SAP Service Marketplace. If you want to find out whether you are affected by this problem, refer to section "Detecting whether SAP will not start up due to missing MS patch" in the attached PDF document.

• Your SAP system runs fine but you did not apply the Microsoft security fix mentioned above. However, future downloads of SAP binaries from SAP Service Marketplace might not work (depending on release, EX2 kernel, etc.).

In both cases, we strongly recommend that you apply the Microsoft security patch as described below.

Other terms

969706 ATL Microsoft security patch SideBySide Dependant Assembly Microsoft VC80.CRT Resolve Partial Assembly failed The system cannot execute the specified program This application has failed to start because the application configuration is incorrect Reinstalling the application may fix this problem

Reason and Prerequisites

You run an SAP system on Windows Server 2003 or Windows Server 2008 and you have not yet applied the MS security patch.

If you are running an SAP system with kernel 7.01 and higher and you downloaded and applied a new kernel patch from SAP Service Marketplace, you cannot start your SAP system without the Microsoft security patch. The same applies for SAP systems older than 7.01 that run with an EX2 kernel.

If you are running an SAP system with a kernel below 7.01 and without the EX2 kernel, your SAP system starts properly. However, you still need to apply the MS security patch to avoid the severe security risk.

Starting with the following patch levels the SAP kernel requires the runtime fix:

I386:

SAP kernel release	Patch level
4.6D EX2	2489
6.40 EX2	308
7.01	68
7.10	178
7.11	62
7.20	30

IA64:

SAP kernel release	Patch level
4.6D EX2	2492
6.40 EX2	310
7.01	68 (NUC) 67 (UC)
7.10	178
7.11	63 (NUC) 64 (UC)
7.20	30

AMD64:

SAP kernel release	Patch level
4.6D EX2	n.a.
6.40 EX2	308 (NUC) 312 (UC)
7.01	67
7.10	178
7.11	64
7.20	20

(UC) (NUC) indicates different starting patch levels for unicode and non unicode kernels.

Solution

1. Go to the following link:
http://www.microsoft.com/technet/security/bulletin/MS09-035.mspx

2. Scroll down the page and go to section "Affected Software".

3. Click on the following link:
Microsoft Visual C++ 2005 Service Pack 1 Redistributable Package (KB973544)

4. Scroll down to section "Files in This Download".

5. Download one of the following platform-specific files:

• For an Itanium system, download vcredist_IA64.exe

• For a 64-Bit SAP system on Intel 64-Bit, download vcredist_x64.exe

• For a 32-Bit SAP system on Intel 64-Bit, download vcredist_x86.exe

• For an SAP system on Intel 32-Bit, download vcredist_x86.exe

6. Execute the downloaded binary by double-clicking on it and follow the instructions.

For more information, see the attached document.