Progress Database BINPATHX Environment Variable Buffer Overflow Vulnerability

Bugtraq ID:	7352
Class:	Boundary Condition Error
CVE:
Remote:	No
Local:	Yes
Published:	Apr 15 2003 12:00AM
Updated:	Apr 15 2003 12:00AM
Credit:	The discovery of this vulnerability has been credited to SnoSoft.
Vulnerable:	Progress Database 9.1 D - HP HP-UX 11.0 - IBM AIX 4.3.3 - Microsoft Windows 2000 Professional SP3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Redhat Linux 7.1 - Redhat Linux 7.0 - Redhat Linux 6.2 - Sun Solaris 2.6 - SuSE Linux 7.2
Not Vulnerable:	Progress Database 9.1 D05

Progress Database BINPATHX Environment Variable Buffer Overflow Vulnerability

A vulnerability has been discovered in Progress Database. The problem occurs due to insufficient bounds checking when processing the BINPATHX environment variable. By supplying excessive data in the variable and invoking the database, it may be possible for an attacker to overwrite sensitive locations in memory and thus execute arbitrary code.

All commands executed in this manner would be run with the privileges of the Progress Database.

Progress Database BINPATHX Environment Variable Buffer Overflow Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Progress Database BINPATHX Environment Variable Buffer Overflow Vulnerability

References:

• Progress Database Product Page (Progress)
  
• SRT2003-04-15-1029 - Progres BINPATHX overflow (KF )