Adaptive Server Anywhere Multiple Remote Buffer Overrun Vulnerabilities

Bugtraq ID:	9190
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 10 2003 12:00AM
Updated:	Dec 10 2003 12:00AM
Credit:	These vulnerabilities were discovered by NGSSoftware.
Vulnerable:	Sybase Adaptive Server Anywhere 9.0
Not Vulnerable:

Adaptive Server Anywhere Multiple Remote Buffer Overrun Vulnerabilities

It has been discovered that Adaptive Server Anywhere is prone to multiple remote buffer overrun vulnerabilities. The overruns can occur in a wide number of procedures, stored procedures, and statements. These issues are likely the result of insufficient bounds checking when handling user-supplied input. As a result, a malicious user may potentially be capable of overwriting sensitive locations in memory; ultimately allowing for the execution of arbitrary code with the privileges of the database.

Adaptive Server Anywhere Multiple Remote Buffer Overrun Vulnerabilities

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Adaptive Server Anywhere Multiple Remote Buffer Overrun Vulnerabilities

Solution:
Sybase has addressed this issue in SQL Anywhere 9.0.0 build 1250. Users are advised to upgrade as soon as possible. Further information can be obtained by contacting the vendor or by logging into the following page.

http://downloads.sybase.com/swd/swx/sdsummary.stm?baseprodName=SQL+Anywhere+
Studio&baseprod=144&client=swx&previewObj=4&timeframeObj=6

Adaptive Server Anywhere Multiple Remote Buffer Overrun Vulnerabilities

References:

• Adaptive Server Anywhere Homepage (Sybase)
  
• Sybase Homepage (Sybase)
  
• Multiple Vulnerabilities Sybase Anywhere 9 ("NGS Software" )