PT-2016-7313 · Sap · Sap Ase

Published 2016-11-03 · Updated 2016-11-28 · CVE-2016-7402

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP ASE versions 16.0 SP02 PL03 and prior

Description The issue allows attackers who own SourceDB and TargetDB databases to elevate privileges to sa (system administrator) via dbcc import sproc SQL injection.

Recommendations For SAP ASE versions 16.0 SP02 PL03 and prior, consider restricting access to the dbcc import sproc function until a patch is available.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2016-7402

Affected Products

Sap Ase

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-7402 · Security Note
• https://osv.dev/vulnerability/CVE-2016-7402 · Vendor Advisory
• https://trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-017/?fid=8409 · Note
• http://securityfocus.com/bid/92950 · Note