Sybase EAServer WebConsole buffer overflow
Added: 11/04/2005CVE: CVE-2005-2297
BID: 14287
OSVDB: 17995
Background
Sybase EAServer is a web application server.Problem
A buffer overflow in the Sybase EAServer WebConsole allows a remote attcker to execute arbitrary commands by requesting /WebConsole/Login.jsp with a long query string.Resolution
Install the patch referenced in the Sybase security advisory.References
http://www.sybase.com/detail?id=1036836Limitations
This exploit only works when it is the first connection to the web console. Since SAINTexploit's port scan will precede the exploit, the exploit will not work when an automated penetration test is performed.Platforms
Windows 2000Windows XP
Back to exploit index