Sybase Adaptive Server Enterprise (ASE) Java Operating System Command Execution Vulnerability

Bugtraq ID:	55803
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 04 2012 12:00AM
Updated:	Oct 04 2012 12:00AM
Credit:	Esteban Martinez Fayo
Vulnerable:	Sybase Adaptive Server Enterprise 15.0 Sybase Adaptive Server Enterprise 15.7 Sybase Adaptive Server Enterprise 15.5
Not Vulnerable:	Sybase Adaptive Server Enterprise 15.7 ESD#1 Refresh 2 Sybase Adaptive Server Enterprise 15.7 ESD#1 Refresh 1 Sybase Adaptive Server Enterprise 15.5 ESD#5.1 Sybase Adaptive Server Enterprise 15.0.3 ESD#4.1

Sybase Adaptive Server Enterprise (ASE) Java Operating System Command Execution Vulnerability

Sybase Adaptive Server Enterprise (ASE) is prone to a remote arbitrary command-execution vulnerability because it fails to properly validate user-supplied input.

An attacker can exploit this issue to execute arbitrary commands within the context of the vulnerable application.

Sybase Adaptive Server Enterprise (ASE) Java Operating System Command Execution Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Sybase Adaptive Server Enterprise (ASE) Java Operating System Command Execution Vulnerability

Solution:
Updates are available. Please see the references for more details.

Sybase Adaptive Server Enterprise (ASE) Java Operating System Command Execution Vulnerability

References:

• Team SHATTER Security Advisory: Java Operating System command execution (Shatter)
  
• Advisory: Sybase Java Operating System command execution vulnerability (Team SHATTER)
  
• Sybase Homepage (Sybase)