EUVD-2002-1557

Malware in sbrugna...

SAP DB 7.3 .00 Symbolic Link Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/6316/info A vulnerability has been discovered in SAP DB that may allow an unprivileged to execute commands with root privileges. The vulnerability is due to insufficient sanity checks by lserver, when attempting to execut...

CVE-2002-1576

lserver in SAP DB 7.3 and earlier uses the current working directory to find and execute the lserversrv program, which allows local users to gain privileges with a malicious lserversrv that is called from a directory that has a symlink to the lserver program...

SAP database local root via symlink

This local attack upon SAP is based on sapdb-server-linux-32bit-i386-73029.tgz it is currently unknown if this affects other SAP flavors. elguapo@rh8 pgm$ pwd /usr/sapdb/depend/pgm elguapo@rh8 pgm$ ls -al lserver -rwsrwxr-x 1 root sapdb 15673 Oct 22 10:42 lserver Using ltrace we can see an attemp...