SAP SQL Anywhere .NET Data Provider Malformed Integer Stack Buffer Overflow Code Execution Vulnerability
December 9th, 2014
Vulnerability Details
This allows attackers to execute arbitrary code on applications which pass user provided data to the vulnerable API in SAP SQL Anywhere.
The specific flaw exists within the handling of a malformed integer constant. If an application allows untrusted input to be used in a query, even if the input is correctly filtered against SQL injection, an attacker could overflow a fixed size stack buffer and execute arbitrary code in the context of the application.
Additional Details
SAP released Security Note 2057277 (http://scn.sap.com/docs/DOC-8218) to address this issue.
Disclosure Timeline
- 2014-04-06 - Vulnerability reported to vendor
- 2014-12-09 - Coordinated public release of advisory
Credit
John Leitch
