[UNIX] MySQL MaxDB Webtool Remote 'If' Stack Overflow

From: SecuriTeam (support_at_securiteam.com)
Date: 04/27/05

  • Next message: SecuriTeam: "[UNIX] ImageMagick ReadPNMImage() Heap Overflow" 
    To: list@securiteam.com
Date: 27 Apr 2005 17:46:31 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      MySQL MaxDB Webtool Remote 'If' Stack Overflow
    ------------------------------------------------------------------------

    SUMMARY

    MaxDB by MySQL is "a re-branded and enhanced version of SAP DB, SAP AG's
    open source database. MaxDB is a heavy-duty, SAP-certified open source
    database that offers high availability, scalability and a comprehensive
    feature set. MaxDB complements the MySQL database server, targeted for
    large mySAP ERP environments and other applications that require maximum
    enterprise-level database functionality".

    A vulnerability in MySQL MaxDB's Webtool's 'If' header supports allows
    remote attackers to cause the program to execute arbitrary code under the
    SYSTEM privileges.

    DETAILS

    Vulnerable Systems:
     * MySQL MaxDB version 7.5.00.23

    Immune Systems:
     * MySQL MaxDB version 7.5.00.26

    The vulnerability specifically exists because of a lack of bounds checking
    in the WebDAV functionality of the web tool. When an attacker issues an
    HTTP request with the unlock method, along with a long "If" parameter
    string, a stack-based overflow occurs.

    Code Snips:
    WDVH_Bool getIfHeader(sapdbwa_HttpRequestP request,
                          WDVH_Char *sIf,
                          WDVH_Int4 len)
    {
    WDVH_Char *temp1, *temp2, *temp4, *temp5;
    WDVH_UInt4 length;
    WDVH_Char temp3[WDVH_MAX_IF_HEADER_LEN];

    if (request==NULL || sIf==NULL)
        return WDVH_False;
      
    strcpy(sIf,"");
    temp4 = (char*)sapdbwa_GetHeader(request,"If");
    if (temp4 != NULL) {
        strcpy(temp3,temp4);

    The variable temp3 is a fixed-length stack buffer. The function
    sapdbwa_GetHeader() returns the user-supplied value for the "If"
    parameter. This user-supplied value is then copied into the fixed-size
    buffer using a strcpy() call. Because there is no boundary checking, it is
    possible to overflow the stack buffer and overwrite stack memory,
    ultimately leading to control of execution flow and execution of arbitrary
    code.

    Note that the vulnerability is in the web administration service, which
    should be configured to not allow connections from untrusted hosts or
    listening on.

    Workaround:
    Filter traffic on TCP port 9999 from untrusted hosts destined for the
    MaxDB Webtool server.

    Disclosure Timeline:
    04/25/2005 - Initial vendor notification
    04/26/2005 - Initial vendor response
    04/26/2005 - Coordinated public disclosure

    ADDITIONAL INFORMATION

    The information has been provided by
    <mailto:idlabs-advisories@idefense.com> iDEFENSE.
    The original article can be found at:
    <http://www.idefense.com/application/poi/display?id=236&type=vulnerabilities> http://www.idefense.com/application/poi/display?id=236&type=vulnerabilities

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[UNIX] ImageMagick ReadPNMImage() Heap Overflow"

    Relevant Pages

    • [REVS] Blind Injection in MySQL Databases (via BENCHMARK)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... MySQL is not an easy database for Blind SQL Injection: ... inside the query itself. ... we find an injection vulnerability that is not ...
      (Securiteam)
    • [UNIX] SAP MaxDB sdbstarter Privilege Escalation Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... SAP MaxDB sdbstarter Privilege Escalation Vulnerability ...
      (Securiteam)
    • [UNIX] MySQL MaxDB WebAgent websql logon Buffer Overflow Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... MaxDB by MySQL is "a re-branded ... MySQL MaxDB could allow attackers to execute arbitrary code. ... The vulnerability specifically exists due to a lack of bounds checking in ...
      (Securiteam)
    • [UNIX] MySQL MaxDB Web Agent Multiple DoS Vulnerabilities (sapdbwa_GetUserData)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... MaxDB by MySQL is "a re-branded ... The second vulnerability is due to insufficient handling of malformed HTTP ... A remote attacker can submit a HTTP request with invalid headers ...
      (Securiteam)
    • [UNIX] SAP MaxDB dbmsrv Untrusted Execution Path Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... SAP MaxDB dbmsrv Untrusted Execution Path Vulnerability ...
      (Securiteam)