Secunia

Some vulnerabilities have been reported in MaxDB, which can be exploited by malicious, local users to gain escalated privileges, and by malicious people to potentially compromise a vulnerable system.

1) A signedness error within the "vserver" component can be exploited to cause a heap corruption via a specially crafted packet sent to the port, which "vserver" is listening on (port 7210/TCP by default).

Successful exploitation may allow execution of arbitrary code, but requires that the name of a local, active database is known.

2) An error exists within the "sdbstarter" program when handling environment variables. This can be exploited by a malicious, local user to execute arbitrary code with root privileges.

Successful exploitation requires that the attacker is a member of the "sdba" group.

The vulnerabilities are reported in version 7.6.0.37. Other versions may also be affected.

Solution
The vendor has reportedly fixed the vulnerabilities with the release of a new version. Contact the vendor for more information.

Provided and/or discovered by
An anonymous researcher, reported via iDefense.

Changelog
Further details available in Customer Area

Original Advisory
iDefense:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=670
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=669

Deep Links
Links available in Customer Area