DM Database Server 'SP_DEL_BAK_EXPIRED' Memory Corruption Vulnerability

Bugtraq ID:	40460
Class:	Boundary Condition Error
CVE:	CVE-2010-2159
Remote:	Yes
Local:	No
Published:	May 31 2010 12:00AM
Updated:	Jun 08 2010 10:29AM
Credit:	Shennan Wang HuaweiSymantec SRT
Vulnerable:	Dameng DM Database Server 0
Not Vulnerable:

DM Database Server 'SP_DEL_BAK_EXPIRED' Memory Corruption Vulnerability

DM Database Server is a database application.

DM Database Server is prone to a remote memory-corruption vulnerability. This issue affects the 'CALL SP_DEL_BAK_EXPIRED' function when a large string is passed to the first argument.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

DM Database Server 'SP_DEL_BAK_EXPIRED' Memory Corruption Vulnerability

A proof of concept is available.

CALL SP_DEL_BAK_EXPIRED('AAAAAAAAAAAAAAAAAAAA', '');

DM Database Server 'SP_DEL_BAK_EXPIRED' Memory Corruption Vulnerability

Solution:
Currently we are not aware of any vendor supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

DM Database Server 'SP_DEL_BAK_EXPIRED' Memory Corruption Vulnerability

References:

• DM Database Server Homepage (Dameng)
  
• DM Database Server Memory Corruption Vulnerabilit ([email protected])