The built-in function DBCC CHECKVERIFY contains a buffer overflow that may allow an attacker to overwrite the stack and execute arbitrary code under the security context of the server. Any valid login in Sybase is able to execute this function.
Vulnerable systems:
* Sybase Adaptive Server version 12.0 and 12.5
Sybase Adaptive Server provides a built-in function called DBCC CHECKVERIFY. This function is used to verify the results of the most recent run of dbcc checkstorage.
DBCC CHECKVERIFY accepts a single parameter that is the name of the database to check. DBCC CHECKVERIFY does not validate the length of the string passed into the first parameter. This buffer overflow may allow an attacker to run arbitrary code under the security context of the database.
Below is an example of overflowing the buffer using the SQL tool isql.exe.
