Micron
22-05-2006, 01:38 AM
Software: SAP R/3
Select a product and view a complete list of all Patched/Unpatched Secunia advisories affecting it.
Description:
Leandro Meiners has reported a vulnerability in SAP, which can be exploited by malicious, local users to gain escalated privileges.
The vulnerability is caused due to an unspecified error in the "sapdba" command within the handling of certain environment variable. This can be exploited by local users to execute arbitrary commands with privileges of the "informix" user.
The vulnerability has been reported in the following versions on the HP-UX, Solaris, AIX, TRUE64, and Linux platforms:
* sapdba command for Informix version prior to 700.
* sapdba command for Informix version 700 up to patch number 100.
Solution:
The vendor has reportedly released a fix for the vulnerability. See SAP note 944585 for details.
Provided and/or discovered by:
Leandro Meiners, Cybsec S.A.
Original Advisory:
http://www.cybsec.com/vuln/CYBSE...lation_in_SAP_sapdba_Command.pdf
Select a product and view a complete list of all Patched/Unpatched Secunia advisories affecting it.
Description:
Leandro Meiners has reported a vulnerability in SAP, which can be exploited by malicious, local users to gain escalated privileges.
The vulnerability is caused due to an unspecified error in the "sapdba" command within the handling of certain environment variable. This can be exploited by local users to execute arbitrary commands with privileges of the "informix" user.
The vulnerability has been reported in the following versions on the HP-UX, Solaris, AIX, TRUE64, and Linux platforms:
* sapdba command for Informix version prior to 700.
* sapdba command for Informix version 700 up to patch number 100.
Solution:
The vendor has reportedly released a fix for the vulnerability. See SAP note 944585 for details.
Provided and/or discovered by:
Leandro Meiners, Cybsec S.A.
Original Advisory:
http://www.cybsec.com/vuln/CYBSE...lation_in_SAP_sapdba_Command.pdf