NGSSoftware Insight Security Research Advisory Name: Multiple Vulnerabilities in Adaptive Server Anywhere Network Server Version 9.0.0 Systems Affected: SQL Anywhere 9 Windows 2000 / XP (Have not been verified on UNIX) Severity: Critical Vendor URL: http://www.sybase.com Authors: Sherief Hammad (Sherief@private) Mark Litchfield (mark@private) Rob Horton (rob@private) Date: 10th December 2003 Advisory URL: http://www.nextgenss.com/advisories/sybase.txt Advisory number: #NISR10122003 Description *********** From Sybase - Adaptive Server Anywhere, the relational database at the core of SQL Anywhere Studio 8, is a transaction-based SQL database designed for personal and workgroup use. Adaptive Server Anywhere runs on a wide range of operating systems, including many flavors of Windows and UNIX, as well as on Novell NetWare. It runs on hardware ranging from multiple-CPU workgroup servers to the most modest PCs, as well as on Windows CE devices. Details ******* In performing an audit for a client, NGS were introduced to Sybase's SQL Anywhere 9. As part of the normal testing conducted by NGS for any client, especially when faced with new software, NGS had to first determine the level of security offered by Sybase's SQL Anywhere 9. Below lists some of our findings. Format String Vulnerability *************************** The extended stored procedure XP_SPRINTF is vulnerable to a format string attack allowing an authenticated user to escalate privileges to 'dba' within the database or the execution of arbitrary code in the context of the process user Buffer Overflows **************** The following CREATE statements are vulnerable to bufferoverrun attacks, again allowing the attacker to run arbitrary code in the context of the process user: - DATABASE - [COMPRESSED | EXPANDED] DATABASE - ENCRYPTED FILE - DECRYPT FILE - DBSPACE - WRITE FILE The above CREATE statements however have a default permission setting of 'DBA' The following ALTER statements are vulnerable to bufferoverrun attacks: - DATABASE - WRITEFILE The above ALTER statements have a default permission setting of 'DBA' The following BACKUP statements are vulnerable to bufferoverrun attacks - DATABASE DIRECTORY - DATABASE TO The above BACKUP statements have a default permission setting of 'DBA' Other statements vulnerable to bufferoverrun attacks include: - INSTALL JAVA - 'dba' - DROP DATABSE - 'dba' - RESTORE DATABASE - 'dba' - START DATABSE - 'defaults to all on personal database server and DBA on network server' The following Stored Procedures and Procedures are vulnerable to Buffer Overrun Attacks: - XP_STARTSMTP - 'DBA - XP_SENDMAIL - 'DBA' - SP_REMOTE_COLUMNS - 'NONE' - SP_REMOTE_EXPORTED_KEYS - 'NONE' - SP_REMOTE_IMPORTED_KEYS - 'NONE' - SP_REMOTE_PRIMARY_KEYS - 'NONE' - SP_REMOTE_TABLES - 'NONE' - SA_FORWARD_TO - 'NONE' - SA_EXEC_SCRIPT - 'DBA' DENIAL OF SERVICE ATTACKS: The following FUNCTIONS allow denial of services attacks to be carried out against Sybase Anywhere 9 - Multiple SET TEMPORARY OPTIONS - DIFFERENCE - PROPERTY - CONNECTION_PROPERTY - CSCONVERT - DB_EXTENDED_PROPERTY - FIRST ESTIMATE - GET_IDENTITY - HEXTOINT - PROPERTY_DESCRIPTION - PROPERTY_NUMBER - IF VAREXISTS - SORTKEY - PRINT Fix Information *************** NGSSoftware alerted SYBASE to in excess of 50 vulnerabilities in NOVEMBER and an update was released on December 5th, a clear demonstration of Sybase's commitment to security. Download the EBF for SQL Anywhere 9.0.0 build 1250 from http://downloads.sybase.com/swd/swx/sdsummary.stm?baseprodName=SQL+Anywhere+ Studio&baseprod=144&client=swx&previewObj=4&timeframeObj=6 Currently NGS are investigating the possibility of developing NGS Squirrel for Sybase to compliment the existing SQuirreL suite found at http://www.nextgenss.com/ngssquirrel.htm About NGSSoftware ***************** NGSSoftware design, research and develop intelligent, advanced application security assessment scanners. Based in the United Kingdom, NGSSoftware have offices in the South of London and the East Coast of Scotland. NGSSoftware's sister company NGSConsulting, offers best of breed security consulting services, specialising in application, host and network security assessments. http://www.ngssoftware.com/ http://www.ngsconsulting.com/ Telephone +44 208 401 0070 Fax +44 208 401 0076 enquiries@private
This archive was generated by hypermail 2b30 : Wed Dec 10 2003 - 09:54:21 PST