PT-2004-1211 · Sap · Sap Db Development Tools

Kf · Published 2004-03-16 · Updated 2017-07-11 · CVE-2003-1033

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SAP DB Development Tools versions 7.x

Description The issue concerns the instdbmsrv and instlserver programs in SAP DB Development Tools, which trust the user-provided INSTROOT environment variable as a path when assigning setuid permissions to the lserver program. This allows local users to gain root privileges via a modified INSTROOT that points to a malicious dbmsrv or lserver program.

Recommendations For SAP DB Development Tools versions 7.x, consider restricting access to the INSTROOT environment variable to prevent malicious modifications. As a temporary workaround, restrict the execution of the lserver program to trusted users only until a patch is available.

Fix

Related Identifiers

CVE-2003-1033

Affected Products

Sap Db Development Tools

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2003-1033 · Security Note
• http://securityfocus.com/bid/7407 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=105103613727471&w=2 · Note
• http://securityfocus.com/bid/7408 · Note
• http://listserv.sap.com/pipermail/sapdb.sources/2003-April/000143.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/11842 · Note