SAP MaxDB 7.6.03 build 007 and earlier allows remote attackers to execute arbitrary commands via "&&" and other shell metacharacters in exec_sdbinfo and other unspecified commands, which are executed when MaxDB invokes cons.exe.

The remote host is running MaxDB, a database server from SAP.

According to its version, the remote server is affected by a multiple flaws :  
  - A vulnerability in 'vserver' process could allow an     unauthenticated attacker to execute arbitrary code,     subject to the privileges of the user under which the     process operates. In order to successfully exploit this     issue an attacker must have prior knowledge of an active     database name on the server. (CVE-2008-0307)

  - A design error in 'sdbstarter', could allow an attacker     to elevate his privileges to root level privileges.
    (CVE-2008-0306)

  - A vulnerability in cons.exe could allow command     execution before authenticating to the database server.
    (CVE-2008-0244)

The remote host is running MaxDB, a database server from SAP.  According to its version, the remote server is affected by multiple flaws.
 
 - A vulnerability in the 'vserver' process could allow an unauthenticated  attacker to execute arbitrary code, subject to the privileges of the user under which the process operates. In order to successfully exploit this issue, an attacker must have prior knowledge of an active database name on the server.
 - A design error in 'sdbstarter' could allow an attacker to elevate his privileges to root level.
 - A vulnerability in cons.exe could allow command execution before authenticating to the database server.

 The version of SAP DB / MaxDB installed on the remote host fails to sanitize user-supplied input to the 'show' and 'exec_sdbinfo' commands before passing it to a 'system()' call.  An unauthenticated remote attacker can leverage this issue to execute arbitrary commands on the affected host subject to the privileges under which the service operates, which under Windows is SYSTEM.

The version of SAP DB / MaxDB installed on the remote host fails to sanitize user-supplied input to the 'show' and 'exec_sdbinfo' commands before passing it to a 'system()' call. An unauthenticated, remote attacker can leverage this issue to execute arbitrary commands on the affected host subject to the privileges under which the service operates, which under Windows is SYSTEM.

ID	Name	Product	Family	Severity
32194	SAP MaxDB Multiple Vulnerabilities	Nessus	Databases	critical
4494	SAP MaxDB Multiple Vulnerabilities	Nessus Network Monitor	Database	critical
4337	SAP DB / MaxDB Cons Program Arbitrary Command Execution	Nessus Network Monitor	Database	high
29924	SAP DB / MaxDB Cons Program Arbitrary Command Execution	Nessus	Databases	high

Detections

Analytics

CVE-2008-0244

critical

Tenable Plugins

critical

critical

high

high