BID:3405

Progress Database JvmStart Format String Vulnerability

Info

Progress Database JvmStart Format String Vulnerability

Bugtraq ID:	3405
Class:	Input Validation Error
CVE:
Remote:	No
Local:	Yes
Published:	Oct 05 2001 12:00AM
Updated:	Oct 05 2001 12:00AM
Credit:	This vulnerability was submitted to BugTraq on October 5th, 2001 by KF <[email protected]>.
Vulnerable:	Progress Database 9.1 C - HP HP-UX 11.0 - IBM AIX 4.3.3 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Redhat Linux 7.1 - Redhat Linux 7.0 - Redhat Linux 6.2 - Sun Solaris 2.6 - SuSE Linux 7.2 Progress Database 8.3 D - HP HP-UX 11.0 - IBM AIX 4.3.3 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Redhat Linux 7.1 - Redhat Linux 7.0 - Redhat Linux 6.2 - Sun Solaris 2.6 - SuSE Linux 7.2

Not Vulnerable:	Progress Database 9.1 D - HP HP-UX 11.0 - IBM AIX 4.3.3 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Redhat Linux 7.1 - Redhat Linux 7.0 - Redhat Linux 6.2 - Sun Solaris 2.6 - SuSE Linux 7.2

Discussion

Progress Database JvmStart Format String Vulnerability

Progress is a commercial database for Microsoft Windows and Unix systems. jvmStart is a program included in Progress Database to start Java Virtual Machine.

An input validation error exists in jvmStart that makes it prone to format string attacks. This issue may allow a local attacker to execute arbitrary code on the host.

This situation could be leveraged by the attacker to gain elevated privileges.

Exploit / POC

Progress Database JvmStart Format String Vulnerability

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Solution / Fix

Progress Database JvmStart Format String Vulnerability

Solution:
Reported fixed in version 9.1D.

References

Progress Database JvmStart Format String Vulnerability

References:

Progress Database Product Page (Progress)