SAP MaxDB Multiple Vulnerabilities

The remote host is running MaxDB, a database server from SAP. According to its version, the remote server is affected by a multiple flaws : - A vulnerability in 'vserver' process could allow an unauthenticated attacker to execute arbitrary code, subject to the privileges of the user under which t...

CVE-2008-0306

sdbstarter in SAP MaxDB 7.6.0.37, and possibly other versions, allows local users to execute arbitrary commands by using unspecified environment variables to modify configuration settings...

SAP MaxDB sdbstarter环境变量本地特权提升漏洞

BUGTRAQ ID: 28185 CVE ID:CVE-2008-0306 CNCVE ID:CNCVE-20080306 SAP's MaxDB是一款商业性质的数据库程序。 SAP's MaxDB包含的"sdbstarter"程序存在设计错误，本地攻击者可以利用漏洞获得ROOT权限。 问题存在于"sdbstarter"程序处理部分环境变量过程中，这些变量用于制定各个MaxDB组件使用的配置设置，由于不正确处理变量数据，可导致以ROOT权限执行任意指令。 SAP MaxDB 7.6.0.37 可参考如下安全公告获得补丁信息SAP note 1140135：...