SAP Security Note
Medium priority
SAP security note 1809246, "Potential information disclosure relating to SAP Sybase ASE", released on September 10, 2013. Below are the symptom and SAP recommended solution.
Description
Symptom
An attacker can discover information relating to SAP Sybase ASE. This information could be used to allow the attacker to specialize their attacks against SAP Sybase ASE.
Solution
This issue has been fixed in the following SAP Sybase ASE versions:
- SAP Sybase ASE 15.7 SP100
- SAP Sybase ASE 15.7 ESD#4.2
- SAP Sybase ASE 15.5 ESD#5.3
- SAP Sybase ASE 15.0.3 ESD#4.3
Update SAP Sybase ASE: Install the fixed SAP Sybase ASE versions most appropriate for your production environments.
Handle Existing Installations: Remove installation log files or restrict permissions on installation log files for customers who have previously installed SAP Sybase ASE.
Reason and prerequisites
Information logged by the SAP Sybase ASE installer may be discovered in installation log files. This information may be used by an attacker to further target SAP Sybase ASE.
CVSS
Score 2.1 Vector: AV:L/AC:L/AU:N/C:P/I:N/A:N
Full note on SAP: SAP Support Launchpad note 1809246
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].