CVE-2003-0938: High severity sap sap db vulnerability
vos24u.c in SAP database server (SAP DB) 7.4.03.27 and earlier allows local users to gain SYSTEM privileges via a malicious "NETAPI32.DLL" in the current working directory, which is found and loaded by SAP DB before the real DLL, as demonstrated using the SQLAT stored procedure.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2003-0938?
CVE-2003-0938 is considered a high-severity vulnerability due to the potential for local users to gain SYSTEM privileges.
How do I fix CVE-2003-0938?
To fix CVE-2003-0938, update your SAP database server to a version later than 7.4.03.27.
Who is affected by CVE-2003-0938?
CVE-2003-0938 affects local users of SAP database server versions 7.4.03.27 and earlier.
What mechanism allows exploitation of CVE-2003-0938?
CVE-2003-0938 can be exploited by placing a malicious NETAPI32.DLL in the current working directory, which SAP DB loads before the legitimate DLL.
What are the potential consequences of CVE-2003-0938?
The potential consequences of CVE-2003-0938 include unauthorized access and control over the database server, leading to data breaches.