Sybase Adaptive Server Enterprise (ASE) Security Vulnerabilities

Release date:
Updated on:

Affected Systems:
Sybase Adaptive Server Enterprise 15.5
Sybase Adaptive Server Enterprise 15.0.3
Sybase Adaptive Server Enterprise 12.5.3 ESD #1
Description:
--------------------------------------------------------------------------------
Bugtraq id: 57206
 
Sybase Adaptive Server Enterprise is a relational database management system.
 
Sybase Adaptive Server Enterprise (ASE) has multiple security vulnerabilities, local users can exploit these vulnerabilities to expose sensitive information, escalate permissions, bypass security restrictions, control affected systems, execute SQL injection attacks, operate certain data, and cause denial of service.
 
1. An error occurred while creating the proxy table, which can be exploited to bypass certain security restrictions.
 
2. An error occurred while creating a table using the ASE plug-in of Sybase Central. You can bypass some security restrictions.
 
3. Some inputs are used in SQL queries if they are not properly filtered. By injecting any SQL code, you can use the SQL query operations.
 
4. An error occurs when processing the Installation Log File, which can be exploited to leak sensitive information.
 
5. The stack buffer overflow and permission escalation can be caused by unspecified details and errors.
 
6. Dos may be caused by untitled details errors
 
7. stack buffer overflow caused by untitled details Error
 
8. Exploitation of unknown details can damage some server files
 
9. Unknown details may be exploited to execute arbitrary Java code
 
<* Source: Martin Rakhmanov

Link: http://secunia.com/advisories/51737/
Http://www.sybase.com/detail? Id = 1099305
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:
 
Sybase
------
Sybase has released a Security Bulletin (1099305) and corresponding patches for this purpose:
 
1099305: Urgent from Sybase: Security vulnerabilities in Adaptive Server Enterprise (ASE)
 
Link: http://www.sybase.com/detail? Id = 1099305
 
Patch download: http://downloads.sybase.com/