Sybase Advantage Server Off-By-One Buffer-Overflow Vulnerability
Sybase Advantage Server is prone to an off-by-one buffer-overflow vulnerability. Attackers may exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts may result in a denial-of-service condition. The problem is enough unusual and affects the code that handles a certain type of packets on the UDP port. In short the server does the following: it uses memcpy to copy the data from the packet into a stack buffer of 0x400 bytes, it uses strlen to calculate the length of the data, it uses memcpy to copy the data into another stack buffer of 0x400 bytes. The problem is that the second memcpy is not limited to the length calculated by strlen and this can cause a buffer-overflow of 1 byte (the last one) if the data is longer than 0x400 bytes. The overflow can be triggered by sending a packet with a length of 0x400 bytes or more to the UDP port of the server.
