Check Point Advisories

Sybase EAServer WebConsole Buffer Overflow (CVE-2005-2297)

Vulnerability
Protection

Check Point Reference:	CPAI-2005-274
Date Published:	29 Nov 2009
Severity:	High
Last Updated:	Sunday 29 November, 2009
Source:
Industry Reference:	CVE-2005-2297
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?
Vulnerability Description	Sybase EAServer is a web service application server suite. The software provides a web-based management console to allow a remote user using a web browser to perform database administration tasks. The communication between the client and the web-based management console is encapsulated in the HTTP protocol. In a default installation, the web console is configured on port TCP/8080, under URL path /WebConsole/. There exists a stack based buffer overflow in Sybase Enterprise Application Server. The vulnerability exists due to a boundary error in the processing of HTTP requests directed to the WebConsole. An unauthenticated remote attacker can exploit this vulnerability to cause a denial of service condition or execute arbitrary code. Any code execution will occur with the privileges of the running server, normally administrative. In a simple attack case aimed at creating a denial of service condition, the affected Sybase EAServer and all supplied services will terminate. In a sophisticated attack scenario where the malicious user is successful in injecting and executing supplied code, the behaviour of the system is dependent on the nature the injected code. Any code injected into the vulnerable component would execute in the security context of the jagsrv.exe process.

Protection Overview

This protection will detect and block attempts to exploit this vulnerabilityNote that in order for this defense to protect your Sybase EAServer, you will need to configure port 8080 (which is also the HTTP proxy port) to work with the HTTP protocol. You need to do the following:1. In the Services tree, click on TCP > HTTP_and_HTTPS_proxy. The TCP Service Properties window opens.2. Click on Advanced. Select the Protocol Type: HTTP.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

In the IPS tab, click Protections and find the Sybase EAServer WebConsole Buffer Overflow protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: Web Server Enforcement Violation.
Attack Information: Sybase EAServer WebConsole buffer overflow