SAP security note 1893562, “Potential Information Disclosure relating to SAP Sybase ASE”, is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
An attacker can discover information relating to SAP Sybase ASE. This information could be used to allow the attacker to specialize their attacks against SAP Sybase ASE.
Solution
This issue has been fixed in the following SAP Sybase ASE versions:
- SAP Sybase ASE 15.7 SP100
- SAP Sybase ASE 15.7 SP50
- SAP Sybase ASE 15.5 ESD#5.3
- SAP Sybase ASE 15.0.3 ESD#4.3
Install the fixed SAP Sybase ASE versions most appropriate for your production environments.
In addition, maintain strict access controls on existing database dump files to reduce the risk of information disclosure.
Reason and prerequisites
Information about SAP Sybase ASE may be discovered in database dump files. This information may be used by an attacker to create targeted attacks against SAP Sybase ASE.
CVSS
Score 7.2 Vector: AV:L/AC:L/AU:N/C:C/I:C/A:C
Full note on SAP: SAP Support Launchpad note 1893562
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].