PT-2004-1211 · Sap · Sap Db Development Tools

Kf · Publicado 2004-03-16 · Atualizado 2017-07-11 · CVE-2003-1033

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SAP DB Development Tools versions 7.x

Description The issue concerns the instdbmsrv and instlserver programs in SAP DB Development Tools, which trust the user-provided INSTROOT environment variable as a path when assigning setuid permissions to the lserver program. This allows local users to gain root privileges via a modified INSTROOT that points to a malicious dbmsrv or lserver program.

Recommendations For SAP DB Development Tools versions 7.x, consider restricting access to the INSTROOT environment variable to prevent malicious modifications. As a temporary workaround, restrict the execution of the lserver program to trusted users only until a patch is available.

Correção

Identificadores relacionados

CVE-2003-1033

Produtos afetados

Sap Db Development Tools

Referências · 6

• http://marc.info/?l=bugtraq&m=105103613727471&w=2 · Nota
• http://securityfocus.com/bid/7408 · Nota
• http://listserv.sap.com/pipermail/sapdb.sources/2003-April/000143.html · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11842 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2003-1033 · Nota de Segurança
• http://securityfocus.com/bid/7407 · Aviso do Fabricante