NGSSoftware Insight Security Research Advisory

Name: Multiple Vulnerabilities in Adaptive Server Anywhere Network Server
Version 9.0.0
Systems Affected: SQL Anywhere 9 Windows 2000 / XP (Have not been verified
on UNIX)
Severity: Critical
Vendor URL: http://www.sybase.com
Authors:    Sherief Hammad (Sherief@ngssoftware.com)
                 Mark Litchfield (mark@ngssoftware.com)
                 Rob Horton (rob@ngssoftware.com)
Date: 10th December 2003
Advisory URL: http://www.nextgenss.com/advisories/sybase.txt
Advisory number: #NISR10122003

Description
***********

From Sybase - Adaptive Server Anywhere, the relational database at the core
of SQL Anywhere Studio 8, is a transaction-based SQL database designed for
personal and workgroup use. Adaptive Server Anywhere runs on a wide range of
operating systems, including many flavors of Windows and UNIX, as well as on
Novell NetWare. It runs on hardware ranging from multiple-CPU workgroup
servers to the most modest PCs, as well as on Windows CE devices.


Details
*******

In performing an audit for a client, NGS were introduced to Sybase's SQL
Anywhere 9.  As part of the normal testing conducted by NGS for any client,
especially when faced with new software, NGS had to first determine the
level of security offered by Sybase's SQL Anywhere 9.  Below lists some of
our findings.

Format String Vulnerability
***************************

The extended stored procedure XP_SPRINTF is vulnerable to a format string
attack allowing an authenticated user to escalate privileges to 'dba' within
the database or the execution of arbitrary code in the context of the
process user


Buffer Overflows
****************

The following CREATE statements are vulnerable to bufferoverrun attacks,
again allowing the attacker to run arbitrary code in the context of the
process user:

-  DATABASE
-  [COMPRESSED | EXPANDED] DATABASE
-  ENCRYPTED FILE
-  DECRYPT FILE
-  DBSPACE
-  WRITE FILE

The above CREATE statements however have a default permission setting of
'DBA'


The following ALTER statements are vulnerable to bufferoverrun attacks:

-  DATABASE
-  WRITEFILE

The above ALTER statements have a default permission setting of 'DBA'


The following BACKUP statements are vulnerable to bufferoverrun attacks

-  DATABASE DIRECTORY
-  DATABASE TO

The above BACKUP statements have a default permission setting of 'DBA'


Other statements vulnerable to bufferoverrun attacks include:

-  INSTALL JAVA - 'dba'
-  DROP DATABSE - 'dba'
-  RESTORE DATABASE - 'dba'
-  START DATABSE - 'defaults to all on personal database server and DBA on
network server'


The following Stored Procedures and Procedures are vulnerable to Buffer
Overrun Attacks:

-  XP_STARTSMTP - 'DBA
-  XP_SENDMAIL - 'DBA'
-  SP_REMOTE_COLUMNS - 'NONE'
-  SP_REMOTE_EXPORTED_KEYS - 'NONE'
-  SP_REMOTE_IMPORTED_KEYS - 'NONE'
-  SP_REMOTE_PRIMARY_KEYS - 'NONE'
-  SP_REMOTE_TABLES - 'NONE'
-  SA_FORWARD_TO - 'NONE'
-  SA_EXEC_SCRIPT - 'DBA'

DENIAL OF SERVICE ATTACKS:

The following FUNCTIONS allow denial of services attacks to be carried out
against Sybase Anywhere 9

-  Multiple SET TEMPORARY OPTIONS
-  DIFFERENCE
-  PROPERTY
-  CONNECTION_PROPERTY
-  CSCONVERT
-  DB_EXTENDED_PROPERTY
-  FIRST ESTIMATE
-  GET_IDENTITY
-  HEXTOINT
-  PROPERTY_DESCRIPTION
-  PROPERTY_NUMBER
-  IF VAREXISTS
-  SORTKEY
-  PRINT

Fix Information
***************

NGSSoftware alerted SYBASE to in excess of 50 vulnerabilities in NOVEMBER
and an update was released on December 5th, a clear demonstration of
Sybase's commitment to security.  Download the EBF for SQL Anywhere 9.0.0
build 1250 from
http://downloads.sybase.com/swd/swx/sdsummary.stm?baseprodName=SQL+Anywhere+
Studio&baseprod=144&client=swx&previewObj=4&timeframeObj=6

Currently NGS are investigating the possibility of developing NGS Squirrel
for Sybase to compliment the existing SQuirreL suite found at
http://www.nextgenss.com/ngssquirrel.htm

About NGSSoftware
*****************
NGSSoftware design, research and develop intelligent, advanced application
security assessment scanners. Based in the United Kingdom, NGSSoftware have
offices in the South of London and the East Coast of Scotland. NGSSoftware's
sister company NGSConsulting, offers best of breed security consulting
services, specialising in application, host and network security
assessments.

http://www.ngssoftware.com/
http://www.ngsconsulting.com/

Telephone +44 208 401 0070
Fax +44 208 401 0076

enquiries@ngssoftware.com