PT-2023-4104 · Sap · Sap Sql Anywhere

Published 2023-07-10 · Updated 2024-09-28 · CVE-2023-33990

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP SQL Anywhere version 17.0

Description The issue allows an attacker to prevent legitimate users from accessing the service by crashing it. An attacker with a low-privileged account and access to the local system can write into shared memory objects, potentially leading to a Denial of Service. Additionally, an attacker might be able to modify sensitive data in shared memory objects. This issue only affects SAP SQL Anywhere on Windows, with other platforms not being impacted.

Recommendations For SAP SQL Anywhere version 17.0, consider restricting access to shared memory objects to minimize the risk of exploitation. As a temporary workaround, limit the ability of low-privileged accounts to write into shared memory objects until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Permission

Weakness Enumeration

CWE-732

CWE-277

Related Identifiers

BDU:2023-04412

CVE-2023-33990

Affected Products

Sap Sql Anywhere

References · 9

• https://osv.dev/vulnerability/CVE-2023-33990 · Vendor Advisory
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04412 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-33990 · Security Note
• https://me.sap.com/notes/3331029 · Note
• https://t.me/cvenotify/96483 · Telegram Post
• https://t.me/cvenotify/54037 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2023072751 · Note
• https://github.com/advisories/GHSA-fj2m-7r3q-j27x · Note