SAP MaxDB Signedness Error Heap Corruption Vulnerability（Public Advisory: 03.10.08 // iDefense Labs）

SAPのMaxDBに任意のコマンドが実行可能な脆弱性が存在するそうです。

Remote exploitation of a signedness error in the "vserver" component of SAP AG's MaxDB could allow attackers to execute arbitrary code.
After accepting a connection, the "vserver" process forks and reads parameters from the client into various structures. When doing so, it trusts values sent from the client to be valid. By sending a specially crafted request, an attacker can cause heap corruption. This leads to a potentially exploitable memory corruption condition.

TCP/7210でセッションを確立してからアクティブなデータベース名を知っていたら、Exploit可能とのこと。

Exploitation allows an attacker to execute arbitrary code in the context of the running service. In order to exploit this vulnerability, an attacker must be able to establish a TCP session on port 7210 with the target host. Additionally, the attacker must know the name of an active database on the server.
Since this service uses the fork() system call once a connection has been accepted, an attacker can repeatedly attempt to exploit this vulnerability. Some exploitation attempts may result in the database process ceasing to run, in which case further exploitation attempts will not be possible.

---