PT-2004-3657 · Sybase · Sap Sybase Adaptive Server Enterprise

Chris Anley

+2

·

Publicado

2004-12-22

·

Atualizado

2017-07-11

·

CVE-2005-0441

CVSS v2.0

10

Alta

VetorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Sybase Adaptive Server Enterprise (ASE) versions prior to 12.5.3 ESD#1
Description The issue allows remote authenticated users to execute arbitrary code via several vulnerable functions, including the attrib valid function, covert function, declare statement, or a crafted query plan. Additionally, remote authenticated users with database owner or "sa" role privileges can execute arbitrary code via a crafted install java statement.
Recommendations For versions prior to 12.5.3 ESD#1, update to version 12.5.3 ESD#1 or later to resolve the issue. As a temporary workaround, consider restricting access to the attrib valid function, covert function, declare statement, and install java statement to minimize the risk of exploitation.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2005-0441

Produtos afetados

Sap Sybase Adaptive Server Enterprise