Risks
Vulnerabilities
Browse by
ASI Sybase DBCC CHECKVERIFY Buffer Overflow Vulnerability
28 November 2002
Bookmark and Share
From: Aaron C. Newman (Application Security, Inc.) <anewman@appsecinc.com>

Sybase Adaptive Server buffer overflow in DBCC CHECKVERIFY

http://www.appsecinc.com/resources/alerts/sybase/02-0001.html

To determine if youshould apply this hot fix, download AppDetective for Sybase from http://www.sybasesecurity.net/products/appdetective/sybase/.

Risk level: High

Threat: Allows a non-privileged login to gain full control of the server

Versions Affected: Sybase Adaptive Server 12.0 and 12.5

Summary:
Sybase Adaptive Server provides a built-in function called DBCC CHECKVERIFY. This function is used to verify the results of the most recent run of DBCC CHECKSTORAGE.

Details:
DBCC CHECKVERIFY accepts a single parameter that is the name of the database to check. DBCC CHECKVERIFY does not validate the length of the string passed into the first parameter. This buffer overflow may allow an attacker to run arbitrary code under the security context of the server.

Below is an example of overflowing the buffer using the SQL tool isql.exe.

1> declare @test varchar(16384)
2> select @test = replicate(A, 16384)
3> DBCC CHECKVERIFY(@test)
4> go

Fix:
You should apply the following patches:
12.5.0.2 - 11/14/2002
12.0.0.6 ESD#1 - 11/5/2002

These patches can be downloaded from http://downloads.sybase.com/swd/swx

Thank you,
support@appsecinc.com
Application Security, Inc.
phone: 212-490-6022
fax: 212-490-6456
-Protection Where It Counts-

Application Security, Inc.
www.appsecinc.com

As pioneers in application security, we are an organization dedicated to the security, defense, and protection of one of the most commonly overlooked areas of security - the application layer. Application Security, Inc. provides solutions to proactively secure (penetration testing/vulnerability assessment), actively defend/monitor (intrusion detection), and protect (encryption) your most critical applications.


Spotlight

Staples customers likely the latest victims of credit card breach

Posted on 21 October 2014.  |  Multiple banks say they have identified a pattern of credit and debit card fraud suggesting that several Staples Inc. office supply locations in the Northeastern United States are currently dealing with a data breach.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Thu, Oct 23rd
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //