Sybase OneBridge Server and DMZ Proxy Format String Vulnerability

Bugtraq ID:	46905
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 08 2011 12:00AM
Updated:	Jun 03 2011 06:00PM
Credit:	Luigi Auriemma
Vulnerable:	Sybase OneBridge 5.6 Sybase OneBridge 5.5
Not Vulnerable:

Sybase OneBridge Server and DMZ Proxy Format String Vulnerability

Sybase OneBridge Server and DMZ Proxy are prone to a format-string vulnerability.

An attacker may exploit this issue to execute arbitrary code in the context of the vulnerable application. Failed exploit attempts will likely result in a denial-of-service condition.

NOTE (June 3, 2011): This BID was previously titled 'Sybase OneBridge Server and DMZ Proxy Unspecified Security Vulnerability'; it has been updated to better reflect the nature of the vulnerability.

Sybase OneBridge Server and DMZ Proxy Format String Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Sybase OneBridge Server and DMZ Proxy Format String Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Sybase OneBridge Server and DMZ Proxy Format String Vulnerability

References:

• OneBridge Product Page (Sybase)
  
• ZDI-11-171: Sybase OneBridge Mobile Data Suite Format String Remore Code Execut (ZDI Disclosures )
  
• Urgent from Sybase: OneBridge Vulnerability. (Sybase)
  
• ZDI-11-171 Sybase OneBridge Mobile Data Suite Format String Remote Code Executio (Zero Day Initiative)