Missing authorization check in SAP Sybase ASE, SAP security note 1849356

SAP Note 1849356
SAP Security Note
Medium priority

SAP security note 1849356, "Missing authorization check in SAP Sybase ASE", is a program error note released on 10.09.2013. Below are the symptom and SAP recommended solution.

ComponentBasis Components > Sybase Products > Sybase ASE Database Platform (non Business Suite)

CategoryProgram error

PriorityCorrection with medium priority

TypeSAP Security Note

StatusReleased for Customer

Released on10.09.2013

Description

Symptom

An authenticated user can use functions of SAP Sybase ASE to which access should be restricted. This may result in an escalation of privileges.

Solution

This issue has been fixed in the following SAP Sybase ASE versions:

SAP Sybase ASE 15.7 SP100
SAP Sybase ASE 15.7 ESD#4.2
SAP Sybase ASE 15.5 ESD#5.2
SAP Sybase ASE 15.0.3 ESD#4.2

Install the fixed SAP Sybase ASE versions most appropriate for your production environments.

Reason and prerequisites

SAP Sybase ASE does not contain authorization checks for checking an authenticated user's authorization to access some of its functions. This may result in undesired system behavior.

CVSS

Score 8.5 Vector: AV:N/AC:M/AU:S/C:C/I:C/A:C

Full note on SAP: SAP Support Launchpad note 1849356

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Authorization #authorization check #SAP Sybase ASE