exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

sybase.txt

sybase.txt
Posted Dec 15, 2003
Authored by Mark Litchfield, Sherief Hammad, Rob Horton | Site ngssoftware.com

Sybase Adaptive Server Anywhere v9.0.0, the relational database at the core of SQL Anywhere Studio 8 contains over 50 vulnerabilities including format string overflows, buffer overflows, and denial of service conditions. Fix available here.

tags | advisory, denial of service, overflow, vulnerability
SHA-256 | 85b020d178f9754cbb630b420899e0a35ec15ff5fd3c3ba755e03d19390d2f14

sybase.txt

Change Mirror Download
NGSSoftware Insight Security Research Advisory

Name: Multiple Vulnerabilities in Adaptive Server Anywhere Network Server
Version 9.0.0
Systems Affected: SQL Anywhere 9 Windows 2000 / XP (Have not been verified
on UNIX)
Severity: Critical
Vendor URL: http://www.sybase.com
Authors: Sherief Hammad (Sherief@ngssoftware.com)
Mark Litchfield (mark@ngssoftware.com)
Rob Horton (rob@ngssoftware.com)
Date: 10th December 2003
Advisory URL: http://www.nextgenss.com/advisories/sybase.txt
Advisory number: #NISR10122003

Description
***********

From Sybase - Adaptive Server Anywhere, the relational database at the core
of SQL Anywhere Studio 8, is a transaction-based SQL database designed for
personal and workgroup use. Adaptive Server Anywhere runs on a wide range of
operating systems, including many flavors of Windows and UNIX, as well as on
Novell NetWare. It runs on hardware ranging from multiple-CPU workgroup
servers to the most modest PCs, as well as on Windows CE devices.


Details
*******

In performing an audit for a client, NGS were introduced to Sybase's SQL
Anywhere 9. As part of the normal testing conducted by NGS for any client,
especially when faced with new software, NGS had to first determine the
level of security offered by Sybase's SQL Anywhere 9. Below lists some of
our findings.

Format String Vulnerability
***************************

The extended stored procedure XP_SPRINTF is vulnerable to a format string
attack allowing an authenticated user to escalate privileges to 'dba' within
the database or the execution of arbitrary code in the context of the
process user


Buffer Overflows
****************

The following CREATE statements are vulnerable to bufferoverrun attacks,
again allowing the attacker to run arbitrary code in the context of the
process user:

- DATABASE
- [COMPRESSED | EXPANDED] DATABASE
- ENCRYPTED FILE
- DECRYPT FILE
- DBSPACE
- WRITE FILE

The above CREATE statements however have a default permission setting of
'DBA'


The following ALTER statements are vulnerable to bufferoverrun attacks:

- DATABASE
- WRITEFILE

The above ALTER statements have a default permission setting of 'DBA'


The following BACKUP statements are vulnerable to bufferoverrun attacks

- DATABASE DIRECTORY
- DATABASE TO

The above BACKUP statements have a default permission setting of 'DBA'


Other statements vulnerable to bufferoverrun attacks include:

- INSTALL JAVA - 'dba'
- DROP DATABSE - 'dba'
- RESTORE DATABASE - 'dba'
- START DATABSE - 'defaults to all on personal database server and DBA on
network server'


The following Stored Procedures and Procedures are vulnerable to Buffer
Overrun Attacks:

- XP_STARTSMTP - 'DBA
- XP_SENDMAIL - 'DBA'
- SP_REMOTE_COLUMNS - 'NONE'
- SP_REMOTE_EXPORTED_KEYS - 'NONE'
- SP_REMOTE_IMPORTED_KEYS - 'NONE'
- SP_REMOTE_PRIMARY_KEYS - 'NONE'
- SP_REMOTE_TABLES - 'NONE'
- SA_FORWARD_TO - 'NONE'
- SA_EXEC_SCRIPT - 'DBA'

DENIAL OF SERVICE ATTACKS:

The following FUNCTIONS allow denial of services attacks to be carried out
against Sybase Anywhere 9

- Multiple SET TEMPORARY OPTIONS
- DIFFERENCE
- PROPERTY
- CONNECTION_PROPERTY
- CSCONVERT
- DB_EXTENDED_PROPERTY
- FIRST ESTIMATE
- GET_IDENTITY
- HEXTOINT
- PROPERTY_DESCRIPTION
- PROPERTY_NUMBER
- IF VAREXISTS
- SORTKEY
- PRINT

Fix Information
***************

NGSSoftware alerted SYBASE to in excess of 50 vulnerabilities in NOVEMBER
and an update was released on December 5th, a clear demonstration of
Sybase's commitment to security. Download the EBF for SQL Anywhere 9.0.0
build 1250 from
http://downloads.sybase.com/swd/swx/sdsummary.stm?baseprodName=SQL+Anywhere+
Studio&baseprod=144&client=swx&previewObj=4&timeframeObj=6

Currently NGS are investigating the possibility of developing NGS Squirrel
for Sybase to compliment the existing SQuirreL suite found at
http://www.nextgenss.com/ngssquirrel.htm

About NGSSoftware
*****************
NGSSoftware design, research and develop intelligent, advanced application
security assessment scanners. Based in the United Kingdom, NGSSoftware have
offices in the South of London and the East Coast of Scotland. NGSSoftware's
sister company NGSConsulting, offers best of breed security consulting
services, specialising in application, host and network security
assessments.

http://www.ngssoftware.com/
http://www.ngsconsulting.com/

Telephone +44 208 401 0070
Fax +44 208 401 0076

enquiries@ngssoftware.com


Login or Register to add favorites

File Archive:

August 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Aug 1st
    20 Files
  • 2
    Aug 2nd
    4 Files
  • 3
    Aug 3rd
    6 Files
  • 4
    Aug 4th
    55 Files
  • 5
    Aug 5th
    16 Files
  • 6
    Aug 6th
    0 Files
  • 7
    Aug 7th
    0 Files
  • 8
    Aug 8th
    13 Files
  • 9
    Aug 9th
    13 Files
  • 10
    Aug 10th
    0 Files
  • 11
    Aug 11th
    0 Files
  • 12
    Aug 12th
    0 Files
  • 13
    Aug 13th
    0 Files
  • 14
    Aug 14th
    0 Files
  • 15
    Aug 15th
    0 Files
  • 16
    Aug 16th
    0 Files
  • 17
    Aug 17th
    0 Files
  • 18
    Aug 18th
    0 Files
  • 19
    Aug 19th
    0 Files
  • 20
    Aug 20th
    0 Files
  • 21
    Aug 21st
    0 Files
  • 22
    Aug 22nd
    0 Files
  • 23
    Aug 23rd
    0 Files
  • 24
    Aug 24th
    0 Files
  • 25
    Aug 25th
    0 Files
  • 26
    Aug 26th
    0 Files
  • 27
    Aug 27th
    0 Files
  • 28
    Aug 28th
    0 Files
  • 29
    Aug 29th
    0 Files
  • 30
    Aug 30th
    0 Files
  • 31
    Aug 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close