Progress Database Multiple Buffer Overflow Vulnerability
BID:3404
Info
Progress Database Multiple Buffer Overflow Vulnerability
| Bugtraq ID: | 3404 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2001-1127 |
| Remote: | No |
| Local: | Yes |
| Published: | Oct 05 2001 12:00AM |
| Updated: | Jul 11 2009 07:56AM |
| Credit: | These vulnerabilities were discovered by KF <[email protected]>. |
| Vulnerable: |
Progress Database 9.1 C Progress Database 9.1 B Progress Database 8.3 D |
| Not Vulnerable: |
Progress Database 9.1 C Progress Database 8.3 V |
Discussion
Progress Database Multiple Buffer Overflow Vulnerability
Progress is a commercial database for Microsoft Windows and Unix systems.
Locally exploitable buffer overflows are prevalent throughout many Progress Database programs. This is largely due to insufficient bounds checking of data which is externally supplied to strcpy functions.
These problems could be exploited to allow a local attacker to execute arbitrary code on a host with the privileges of each individual affected program.
This situation could be leveraged by the attacker to gain root privileges on the host.
Progress is a commercial database for Microsoft Windows and Unix systems.
Locally exploitable buffer overflows are prevalent throughout many Progress Database programs. This is largely due to insufficient bounds checking of data which is externally supplied to strcpy functions.
These problems could be exploited to allow a local attacker to execute arbitrary code on a host with the privileges of each individual affected program.
This situation could be leveraged by the attacker to gain root privileges on the host.
Exploit / POC
Progress Database Multiple Buffer Overflow Vulnerability
KF <[email protected]> has provided exploits for multiple Progress binaries:
KF <[email protected]> has provided exploits for multiple Progress binaries:
Solution / Fix
Progress Database Multiple Buffer Overflow Vulnerability
Solution:
Reported fixed in versions 9.1C, 8.3V.
Solution:
Reported fixed in versions 9.1C, 8.3V.
References
Progress Database Multiple Buffer Overflow Vulnerability
References:
References:
- Progress Database Product Page (Progress)