A remote overflow exists in MaxDB. MaxDB fails to perform adequate bounds checking in the WebDAV functionality of the web administration service tool resulting in a stack-based overflow. With a specially crafted HTTP request with the unlock method, along with a long Lock-Token string, a remote attacker can execute arbitrary code with SYSTEM privileges resulting in a loss of integrity.

MaxDB_ORG/sys/src/SAPDB/WebDAV/Handler/WDVHandler_CommonUtils.c:

WDVH_Bool getLockTokenHeader(sapdbwa_HttpRequestP request,
WDVH_Char *sLockToken,
WDVH_Char *errormsg)
{
WDVH_Char *temp1, *temp2, *temp4, *temp5;
WDVH_UInt4 length;
WDVH_Char temp3[WDVH_MAX_IF_HEADER_LEN];

if (request==NULL || sLockToken==NULL || errormsg==NULL)
return WDVH_False;

temp4 = (char*)sapdbwa_GetHeader(request,"Lock-Token");
if (temp4 != NULL) {
strcpy(temp3,temp4);
[...]

The variable temp3 is a fixed-length stack buffer. The function sapdbwa_GetHeader() returns the user supplied value for Lock-Token. This user-supplied value is then copied into the fixed-size buffer using a strcpy() call. Due to no boundary checking, it is possible to overflow the stack buffer and overwrite stack memory, ultimately leading to control of execution flow and execution of arbitrary code.

Upgrade to version 7.5.00.26 or higher, as it has been reported to fix this vulnerability. It is also possible to correct the flaw by implementing the following workaround(s): The vulnerability is in the web administration service, which should be configured to not allow connections from untrusted hosts or listening on public-facing network interfaces.

• Security Tracker: 1013800
• Bugtraq ID: 13369
• Secunia Advisory ID: 15109
• Related OSVDB ID: 15816
• CVE ID: 2005-0684 (see also: NVD)
• ISS X-Force ID: 20270
• Other Advisory URL: http://www.auscert.org.au/render.html?it=5030
  http://www.idefense.com/application/poi/display?id=235&type=vulnerabilities
  http://www.securiteam.com/unixfocus/5JP0O1PFFO.html
• Vendor URL: http://www.mysql.com/products/maxdb/

• Anonymous - iDefense Labs VCP