Clarifications on Sybase Alerts

• Previous message: Jan Rutkowski: "Bypassing Integrity Protection Driver (time vulnerability)"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date:         Tue, 3 Dec 2002 19:47:30 -0500
From: "Aaron C. Newman (Application Security, Inc.)" <anewman@APPSECINC.COM>
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM

We have received a lot of feedback on the 3 Sybase alerts sent out on
November 11 by Application Security, Inc. Being that the Sybase
community has not experienced many security vulnerabilities, there is
some confusion on what is exploitable and what is not. We are hoping
this clears up any confusion.

ASI Sybase Security Alert: Buffer overflow in xp_freedll

Despite the fact that the overflow is in a procedure with "dll" in the
name, this is in fact exploitable on UNIX as well as on Windows for all
versions of 12.0 and 12.5. On UNIX it is used to free shared objects.

ASI Sybase Security Alert: Buffer overflow in DROP DATABASE

These exploits can be run by anyone that can connect to the server, not
just database owners or system administrators. The command DROP DATABASE
is meant to only be run by privileged users, however if a non-privileged
user runs one of these commands, the buffer overflow occurs before any
access control takes place. Therefore a non-privileged user can use this
security hole to take complete control of a Sybase server.

Also, on Sybase 12.5 you can declare VARCHAR data types as large as
16384. On Sybase 12.0, VARCHARs as limited to a max length of 255
characters. Therefore the code example from the advisory with will not
run on Sybase 12.0. For Sybase 12.0 on Solaris, a FATAL error is
generated when executing the statement as a non-privileged user with a
255 character VARCHAR, however based on our research it appears that it
is not exploitable on Sybase 12.0. It is however exploitable on Sybase
12.5 on most platforms.

ASI Sybase Security Alert: Buffer overflow in DBCC CHECKVERIFY

Same as above, this command is meant to only be run by privileged users,
however if a non-privileged user runs one of these commands, the buffer
overflow occurs before any access control takes place. Therefore a
non-privileged user can use this security hole to take complete control
of a Sybase server.

Again, Sybase 12.0 VARCHARs as limited to 255 characters. Therefore the
code example will not run on Sybase 12.0 therefore this version of
Sybase is not vulnerable. Only Sybase 12.5 is vulnerable, however it is
vulnerable on most platforms.

As well there has been feedback (specifically from Sybase) that this is
a "hypothetical" security vulnerability. We have not published exploit
code. There is, however, no doubt that they are exploitable
vulnerabilities. This security hole is very similar to many of the
buffer overflows that have been discovered in Microsoft SQL Server by
Cesar Cerrudo and NGSSoftware. Several white papers which include
exploit code for this problem have been written by the really clever
gents over at NGSSoftware. Below are references to their papers:

http://www.nextgenss.com/papers/tp-SQL2000.pdf - see Appendix B and C
http://www.nextgenss.com/papers/violating_database_security.pdf

Please, we welcome any additional feedback.

Regards,
Aaron
_______________________________
Aaron C. Newman
CTO/Founder
Application Security, Inc.
www.appsecinc.com
Phone: 212-420-9720
Fax: 212-420-9680
- Protection Where It Counts -

oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
Delivery co-sponsored by TruSecure Corporation
oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo
Demonstrate your knowledge and understanding of core IT Security, become
TICSA certified.

Are you responsible for IT security in job function, but not necessarily
in title? Do you want to prove your IT security knowledge and increase
opportunities? Interested? Visit;

http://www.trusecure.com/solutions/certifications/ticsa/

for more information.
oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo

• Next message: Russ: "Alert: Microsoft Security Bulletin - MS02-068"
• Previous message: Jan Rutkowski: "Bypassing Integrity Protection Driver (time vulnerability)"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]