Adaptive Server Anywhere XP_SPRINTF Format String Vulnerability

Bugtraq ID:	9191
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 10 2003 12:00AM
Updated:	Dec 10 2003 12:00AM
Credit:	Discovery of this vulnerability has been credited to NGSSoftware.
Vulnerable:	Sybase Adaptive Server Anywhere 9.0
Not Vulnerable:

Adaptive Server Anywhere XP_SPRINTF Format String Vulnerability

Adaptive Server Anywhere has been reported prone to a format string vulnerability in the extended stored procedure XP_SPRINTF. It has been reported that this vulnerability may be exploited by an authenticated user who has sufficient privileges to pass data to the XP_SPRINTF procedure.

An attacker may exploit this vulnerability to escalate privileges to the 'dba' user within the database, or to escalate privileges to the user the Adaptive Server Anywhere process is running as.

Adaptive Server Anywhere XP_SPRINTF Format String Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

Adaptive Server Anywhere XP_SPRINTF Format String Vulnerability

Solution:
Sybase has addressed this issue in SQL Anywhere 9.0.0 build 1250. Users are advised to upgrade as soon as possible. Further information can be obtained by contacting the vendor or by logging into the following page.

http://downloads.sybase.com/swd/swx/sdsummary.stm?baseprodName=SQL+Anywhere+Studio&baseprod=144&client=swx&previewObj=4&timeframeObj=6

Adaptive Server Anywhere XP_SPRINTF Format String Vulnerability

References:

• Adaptive Server Anywhere Homepage (Sybase)
  
• Multiple Vulnerabilities Sybase Anywhere 9 ("NGS Software" )