CVE-2005-2297
published 2005-07-19CVE-2005-2297: Stack-based buffer overflow in TreeAction.do in Sybase EAServer 4.2.5 through 5.2 allows remote authenticated users to execute arbitrary code via a large…
PriorityP352medium4.6CVSS 2.0
AVLACLAuNCPIPAP
EXPLOIT
EPSS
74.20%
99.4th percentile
Stack-based buffer overflow in TreeAction.do in Sybase EAServer 4.2.5 through 5.2 allows remote authenticated users to execute arbitrary code via a large javascript parameter.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sybase | easerver | — | — |
| sybase | easerver | — | — |
| sybase | easerver | — | — |
| sybase | easerver | — | — |
Detection & IOCsextracted from sources · hover to see the quote
bytes↗
\xeb\x06 (short JMP over SEH overwrite)
- →Detect oversized GET requests to /WebConsole/Login.jsp with a large query string (javascript parameter) exceeding normal bounds (~5000 bytes), indicative of the stack buffer overflow exploit attempt against TreeAction.do / Login.jsp. ↗
- →Monitor HTTP GET requests to port 8080 targeting /WebConsole/Login.jsp with query strings longer than ~3800 characters, which corresponds to the SEH overwrite offsets used in the exploit (3820–3925 bytes). ↗
- →Alert on the exploit's characteristic User-Agent string 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)' combined with an oversized GET request to /WebConsole/Login.jsp on port 8080. ↗
- →Look for the short-jump shellcode stub bytes \xeb\x06 at the SEH overwrite offset within the query string payload, which is the exploit's SEH-based control-flow hijack mechanism. ↗
- →The exploit uses a 5000-byte alphanumeric random buffer with specific return addresses (0x6d4548ff or 0x08041b25) packed at the SEH offset; scanning for these byte sequences in HTTP query strings targeting EAServer can identify exploitation attempts. ↗
- ·The SEH overwrite offset varies depending on the JDK version installed on the target server (offsets range from 3820 to 3925), making the exploit unreliable and meaning detection rules based on a fixed offset may miss some variants. ↗
- ·The exploit payload space is limited to 1000 bytes with a stack adjustment of -3500; payloads larger than 1000 bytes will not fit and the exploit uses a StackAdjustment to relocate the stack pointer before shellcode execution. ↗
- ·The vulnerability requires remote authenticated users, meaning unauthenticated access alone is insufficient to trigger the overflow; detection should account for authenticated sessions preceding the oversized request. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Sybase EAServer 5.2 - Remote Stack Buffer Overflow (Metasploit)
exploitdb·2010-06-22
CVE-2005-2297 Sybase EAServer 5.2 - Remote Stack Buffer Overflow (Metasploit)
Sybase EAServer 5.2 - Remote Stack Buffer Overflow (Metasploit)
---
##
# $Id: sybase_easerver.rb 9583 2010-06-22 19:11:05Z todb $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'Sybase EAServer 5.2 Remote Stack Buffer Overflow',
'Description' => %q{
This module exploits a stack buffer overflow in the Sybase EAServer Web
Console. The offset to the SEH frame appears to change depending
on what version of Java is in use by the remote server, making this
exploit somewhat unreliable.
},
'Author' => [ 'anonymous' ],
'License' => MSF_LICENSE,
'Ver
Metasploit
Sybase EAServer 5.2 Remote Stack Buffer Overflow
metasploit
Sybase EAServer 5.2 Remote Stack Buffer Overflow
Sybase EAServer 5.2 Remote Stack Buffer Overflow
This module exploits a stack buffer overflow in the Sybase EAServer Web Console. The offset to the SEH frame appears to change depending on what version of Java is in use by the remote server, making this exploit somewhat unreliable.
No writeups or analysis indexed.
http://marc.info/?l=bugtraq&m=112146180532313&w=2http://secunia.com/advisories/16108http://securitytracker.com/id?1014497http://www.spidynamics.com/spilabs/advisories/sybaseEAserverOverflow.htmhttp://www.sybase.com/detail?id=1036742http://marc.info/?l=bugtraq&m=112146180532313&w=2http://secunia.com/advisories/16108http://securitytracker.com/id?1014497http://www.spidynamics.com/spilabs/advisories/sybaseEAserverOverflow.htmhttp://www.sybase.com/detail?id=1036742
2005-07-19
Published