PT-2006-3493 · Sap · Sap

Leandro Meiners · Published 2006-05-23 · Updated 2018-10-18 · CVE-2006-2547

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SAP with Informix versions prior to 700, and 700 up to patch 100

Description The issue is related to an unspecified vulnerability in the handling of "insecure environment variable" by the sapdba command, allowing local users to execute arbitrary commands.

Recommendations For versions prior to 700, apply patch 100 or later to resolve the issue. For version 700 up to patch 100, apply patch 100 or later to resolve the issue.

Fix

Related Identifiers

CVE-2006-2547

Affected Products

Sap

References · 10

• http://secunia.com/advisories/20180 · Vendor Advisory
• http://cybsec.com/vuln/CYBSEC_Security_Pre-Advisory_Local_Privilege_Escalation_in_SAP_sapdba_Command.pdf · Patch
• http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/046130.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-2547 · Security Note
• http://securitytracker.com/id?1016122 · Note
• http://vupen.com/english/advisories/2006/1861 · Note
• http://securityfocus.com/archive/1/434534/30/4890/threaded · Note
• http://securityreason.com/securityalert/941 · Note
• http://securityfocus.com/bid/18028 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/26526 · Note