A new set of critical vulnerabilities has found in SAP’s Sybase database software can grant unprivileged attackers complete control over a targeted database and even the underlying operating system in certain scenarios.
Â
Researchers says, users to apply patches for several critical vulnerabilities in SAP’s Adaptive Server Enterprise (ASE). If exploited, the most severe flaws could give unprivileged users complete control of databases and – in some cases – even underlying operating systems.
Â
ASE (previously known as Sybase SQL server) is SAP’s popular database management software, targeted for transactional-based applications. ASE is used by more than 30,000 organizations globally – including 90 percent of the top banks and security firms worldwide, according to SAP.
Â
Researchers disclosed six vulnerabilities that they discovered while conducting security tests for the latest version of the software, ASE 16 (SP03 PL08). While SAP has released patches for both ASE 15.7 and 16.0 in its May 2020 update, researchers disclosed technical details of the flaws on Wednesday, saying “there is no question” that the patches should be applied immediately if they haven’t been already.
Â
As Organizations often store their most critical data in databases, which, in turn, are often necessarily exposed in untrusted or publicly exposed environments. This makes vulnerabilities like these essential to address and test quickly since they not only threaten the data in the database but potentially the full host that it is running on.
