SAP security note 1893558, “Potential remote code execution in SAP Sybase ASE”, is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
An attacker can exploit SAP Sybase ASE to enable them to take complete control of the product, including viewing, changing, or deleting data.
Solution
This issue has been fixed in the following SAP Sybase ASE versions:
- SAP Sybase ASE 15.7 SP100
- SAP Sybase ASE 15.7 SP50
- SAP Sybase ASE 15.5 ESD#5.3
- SAP Sybase ASE 15.0.3 ESD#4.3
Install the fixed SAP Sybase ASE versions most appropriate for your production environments.
Reason and prerequisites
A buffer overflow vulnerability exists in SAP Sybase ASE. This enables an attacker to inject code into the working memory that is subsequently executed by the application. It can also be used to cause a general fault in the product, causing the product to terminate.
CVSS
Score 8.7 Vector: AV:N/AC:L/AU:S/C:C/I:P/A:C
Full note on SAP: SAP Support Launchpad note 1893558
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
