PT-2022-22698 · Sap · Sap Sql Anywhere+1

Published 2022-10-11 · Updated 2023-05-31 · CVE-2022-35299

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP SQL Anywhere version 17.0 SAP IQ version 16.1

Description The issue allows an attacker to leverage logical errors in memory management to cause a memory corruption, such as a Stack-based buffer overflow. This can potentially lead to remote code execution.

Recommendations For SAP SQL Anywhere version 17.0, update to a version that addresses the memory management issues to prevent stack-based buffer overflow. For SAP IQ version 16.1, update to a version that addresses the memory management issues to prevent stack-based buffer overflow.

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2022-35299

ZDI-23-744

Affected Products

Sap Iq

Sap Sql Anywhere

References · 6

• https://osv.dev/vulnerability/CVE-2022-35299 · Vendor Advisory
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://zerodayinitiative.com/advisories/ZDI-23-744 · Security Note
• https://launchpad.support.sap.com/#/notes/3232021 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-35299 · Security Note
• https://t.me/cibsecurity/51208 · Telegram Post