Potential denial of service in SAP Sybase ASE, SAP security note 1887342

SAP security note 1887342, "Potential denial of service in SAP Sybase ASE", is a program error note released on 10.09.2013. Below are the symptom and SAP recommended solution.

Description

Symptom

An attacker can remotely exploit SAP Sybase ASE, rendering it, and potentially the resources that are used to serve ASE, unavailable.

Solution

This issue has been fixed in the following SAP Sybase ASE versions:

• SAP Sybase ASE 15.7 SP100
• SAP Sybase ASE 15.7 ESD#4
• SAP Sybase ASE 15.5 ESD#5.3
• SAP Sybase ASE 15.0.3 ESD#4.3

Install the fixed SAP Sybase ASE versions most appropriate for your production environment.

Reason and prerequisites

An attacker can trigger a condition in which SAP Sybase ASE enters an endless loop, causing it to consume all of the available processing time. This causes the entire machine to become unresponsive until the process is terminated manually. An attacker can use this flaw to launch a denial-of-service (DoS) attack.

CVSS

Score 5.4 Vector: AV:N/AC:H/AU:N/C:N/I:N/A:C