Signature Detail

HTTP: Sybase EAServer WebConsole Buffer Overflow

This signature detects an attempt to exploit a known vulnerability in the Sybase EAServer WebConsole. Sybase EAServer versions 5.2 and earlier are vulnerable. By supplying a maliciously crafted URL request, the client can potentially execute arbitrary commands on the server with daemon permissions.

Extended Description

Sybase EAServer is affected by a remote buffer-overflow vulnerability. The vulnerability exists in the server's WebConsole. A successful attack can overflow a finite-sized buffer and ultimately lead to arbitrary code execution in the context of the 'jagsrv.exe' process. This may allow the attacker to gain elevated privileges. Note that an attacker needs to provide authentication credentials before carrying out this attack.

Affected Products

• Sybase enterprise_application_server 4.2.0
• Sybase enterprise_application_server 4.2.2
• Sybase enterprise_application_server 4.2.5
• Sybase enterprise_application_server 5.0.0
• Sybase enterprise_application_server 5.1.0
• Sybase enterprise_application_server 5.2.0

References

• BugTraq: 14287
• CVE: CVE-2005-2297
• URL: http://www.sybase.com/detail?id=1036742
• URL: http://www.spidynamics.com/spilabs/advisories/sybaseEAserverOverflow.htm