ASI Sybase Security Alert: Buffer overflow in DBCC CHECKVERIFY

From: Aaron C. Newman (Application Security, Inc.) (
Date: 11/27/02

  • Next message: Iván Arce: "RE: CAIS-ALERT: Vulnerability in the sending requests control of BIND"
    From: "Aaron C. Newman (Application Security, Inc.)" <>
    Date: Wed, 27 Nov 2002 14:14:25 -0500

    Sybase Adaptive Server buffer overflow in DBCC CHECKVERIFY

    To determine if you should apply this hot fix, download AppDetective for
    Sybase from

    Risk level: High

    Threat: Allows a non-privileged login to gain full control of the server

    Versions Affected: Sybase Adaptive Server 12.0 and 12.5

    Sybase Adaptive Server provides a built-in function called DBCC
    CHECKVERIFY. This function is used to verify the results of the most
    recent run of DBCC CHECKSTORAGE.

    DBCC CHECKVERIFY accepts a single parameter that is the name of the
    database to check. DBCC CHECKVERIFY does not validate the length of the
    string passed into the first parameter. This buffer overflow may allow
    an attacker to run arbitrary code under the security context of the

    Below is an example of overflowing the buffer using the SQL tool

    1> declare @test varchar(16384)
    2> select @test = replicate(‘A’, 16384)
    3> DBCC CHECKVERIFY(@test)
    4> go

    You should apply the following patches: - 11/14/2002 ESD#1 - 11/5/2002

    These patches can be downloaded from

    Thank you,
    Application Security, Inc.
    phone: 212-490-6022
    fax: 212-490-6456
    -Protection Where It Counts-

    Application Security, Inc.

    As pioneers in application security, we are an organization dedicated
    to the security, defense, and protection of one of the most commonly
    overlooked areas of security - the application layer. Application
    Security, Inc. provides solutions to proactively secure (penetration
    testing/vulnerability assessment), actively defend/monitor (intrusion
    detection), and protect (encryption) your most critical applications.

    Relevant Pages