SAP Sybase Adaptive Server Enterprise SQL Injection (SAP Note 1893440)

high Nessus Plugin ID 70975

Language:

Synopsis

The version of SAP Sybase Adaptive Server Enterprise (ASE) installed on the remote host is affected by a SQL injection vulnerability.

Description

SAP Sybase Adaptive Server Enterprise (ASE) contains a flaw that may allow an attacker to carry out a SQL injection attack. The issue is due to the program not properly sanitizing user-supplied input before using it in SQL queries. This may allow an attacker to inject or manipulate SQL queries in the back-end database, allowing for the manipulation or disclosure of arbitrary data.

Solution

Apply one of the patches listed in the advisory.

Plugin Details

Severity: High

ID: 70975

File Name: sybase_ase_note1893440.nasl

Version: 1.9

Type: local

Agent: windows

Family: Windows

Published: 11/20/2013

Updated: 6/3/2021

Supported Sensors: Nessus Agent, Nessus

Risk Information

CVSS v2

Risk Factor: High

Base Score: 8.5

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/a:sybase:adaptive_server_enterprise

Required KB Items: SMB/Sybase_ASE/Installed

Exploit Ease: No known exploits are available

Patch Publication Date: 4/5/2013

Vulnerability Publication Date: 9/6/2013

Reference Information

BID: 63549

IAVA: 2013-A-0217-S

Detections

Analytics