SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Database)  >   MaxDB Vendors:   SAP
MaxDB 'cons.exe' Lets Remote Users Execute Arbitrary Commands on the Target System
SecurityTracker Alert ID:  1019171
SecurityTracker URL:  http://securitytracker.com/id/1019171
CVE Reference:   CVE-2008-0244   (Links to External Site)
Updated:  Jan 29 2008
Original Entry Date:  Jan 9 2008
Impact:   Execution of arbitrary code via network, User access via network
Exploit Included:  Yes  
Version(s): 7.6.03 build 007 and prior versions
Description:   Luigi Auriemma reported a vulnerability in MaxDB. A remote user can execute arbitrary code on the target system.

A remote user can connect to the target database and execute arbitrary operating system commands on the target system.

A demonstration exploit command (for Windows) is provided:

exec_sdbinfo && echo dir c:\ | cmd.exe

A demonstration exploit is available at:

http://aluigi.org/poc/sapone.zip

Impact:   A remote user can execute arbitrary commands on the target system.
Solution:   No solution was available at the time of this entry.
Vendor URL:  www.sdn.sap.com/irj/sdn/maxdb (Links to External Site)
Cause:   Input validation error
Underlying OS:  Linux (Any), UNIX (AIX), UNIX (HP/UX), UNIX (Solaris - SunOS), UNIX (Tru64), Windows (Any)

Message History:   None.


 Source Message Contents

Subject:  Pre-auth remote commands execution in SAP MaxDB 7.6.03.07

#######################################################################

                             Luigi Auriemma

Application:  SAP MaxDB
              https://www.sdn.sap.com/irj/sdn/maxdb
              http://www.sap.com
Versions:     <= 7.6.03 build 007
Platforms:    Windows, Linux and Solaris
Bug:          pre-auth remote commands execution
Exploitation: remote
Date:         09 Jan 2008
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


SAP MaxDB is a commercial and widely known and used database.


#######################################################################

======
2) Bug
======


The MaxDB server executes "cons.exe DATABASE COMMAND" through system()
when some special commands are called by the user.
Some of these special commands are "show" and "exec_sdbinfo" and this
last one is just one of the small amount of commands which can be
executed by the unauthenticated users before logging in.

The usage of system() for executing the cons program allows an external
unauthenticated attacker to execute any command he wants on the target
SAP MaxDB server simply passing the "&&" or other patterns for the
execution of multiple commands in the shell.

So it's just enough to use the following SAP command to see the content
of C: on Windows (the bug is naturally exploitable on any other
platform supported by the server):

  exec_sdbinfo && echo dir c:\ | cmd.exe

Then the rest and all the other possibilities of exploiting this
vulnerability are in the fantasy of the attacker...


#######################################################################

===========
3) The Code
===========


http://aluigi.org/poc/sapone.zip


#######################################################################

======
4) Fix
======


No fix


#######################################################################


--- 
Luigi Auriemma
http://aluigi.org


 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2020, SecurityGlobal.net LLC