CVE-2014-6283 Missing authorization in n/a

Medium 6.5 Published 17 Oct 2014 Updated 6 Aug 2024

Authenticated database users can overwrite encryption keys or cause buffer overflows via crafted RPC messages in SAP ASE.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2014-6283?

CVE-2014-6283 is a medium-severity missing authorization vulnerability in n/a, published on 17 Oct 2014. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

SAP Adaptive Server Enterprise (ASE) 15.7 before SP122 or SP63, 15.5 before ESD#5.4, and 15.0.3 before ESD#4.4 does not properly restrict access, which allows remote authenticated database users to (1) overwrite the master encryption key or (2) trigger a buffer overflow via a crafted RPC message to the hacmpmsgxchg function, and possibly other vectors.

Weakness: CWE-264

Which versions are affected by CVE-2014-6283?

It affects 1 product.

Products include Sybase Adaptive Server Enterprise.

How do I fix CVE-2014-6283?

No fix has been published for CVE-2014-6283 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2014-6283 being exploited?

There is no known exploitation of CVE-2014-6283 in the wild and no public exploit code.

Sources

Also known as GHSA-vvhg-5jmx-45hj.