Sybase MobiLink Multiple Heap Buffer Overflow Vulnerabilities

Bugtraq ID:	27914
Class:	Boundary Condition Error
CVE:	CVE-2008-0912
Remote:	Yes
Local:	No
Published:	Feb 20 2008 12:00AM
Updated:	May 07 2015 05:32PM
Credit:	Luigi Auriemma is credited with the discovery of these vulnerabilities.
Vulnerable:	Sybase MobiLink 10.0.1.3629
Not Vulnerable:	Sybase SQL Anywhere 10.0.1.3649 Sybase MobiLink 10.0.1.3649

Sybase MobiLink Multiple Heap Buffer Overflow Vulnerabilities

Sybase MobiLink is prone to multiple heap-based buffer-overflow vulnerabilities because the application fails to perform adequate boundary checks on user-supplied data.

A successful exploit will allow remote attackers to execute arbitrary code in the context of the affected software. Failed exploit attempts will likely result in denial-of-service conditions.

These issues affect MobiLink 10.0.1.3629; prior versions may also be affected.

Sybase MobiLink Multiple Heap Buffer Overflow Vulnerabilities

The following exploit code is available:

• /data/vulnerabilities/exploits/27914-mobilinkhof.zip

Sybase MobiLink Multiple Heap Buffer Overflow Vulnerabilities

Solution:
The vendor has released MobiLink 10.0.1.3649 to address these issues. Please contact the vendor for information on obtaining and installing the new version.

Sybase MobiLink Multiple Heap Buffer Overflow Vulnerabilities

References:

• MobiLink Homepage (Sybase)
  
• Sybase Homepage (Sybase)
  
• Heap overflow in Sybase MobiLink 10.0.1.3629 (Luigi Auriemma )
  
• Re: Heap overflow in Sybase MobiLink 10.0.1.3629 ([email protected])