PT-2013-5930 · Sap · Sap Sybase Adaptive Server Enterprise

Igor Bulatenko · Publicado 2013-10-19 · Atualizado 2017-09-13 · CVE-2013-6025

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP Sybase Adaptive Server Enterprise (ASE) version 15.7 ESD 2

Description The issue allows remote authenticated users to read arbitrary files via a SQL statement containing an XML document with an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

Recommendations For SAP Sybase Adaptive Server Enterprise (ASE) version 15.7 ESD 2, consider restricting access to the XMLParse procedure to minimize the risk of exploitation. As a temporary workaround, consider disabling the XMLParse procedure until a patch is available.

Exploit

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2013-6025

Produtos afetados

Sap Sybase Adaptive Server Enterprise

Referências · 7

• 🔥 https://exploit-db.com/exploits/38805 · Exploit
• http://securityfocus.com/bid/63193 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-6025 · Nota de Segurança
• http://secunia.com/advisories/55377 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/88105 · Nota
• http://kb.cert.org/vuls/id/303900 · Nota
• http://securitytracker.com/id/1029208 · Nota