PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5371 Sybase CVE debrief

CVE-2017-5371 is a network-reachable denial-of-service issue in the OData Server component of SAP Adaptive Server Enterprise (ASE) 16. According to the CVE/NVD record, crafted requests can trigger a process crash. The issue is rated High and maps to a validation weakness (CWE-20).

Vendor
Sybase
Product
CVE-2017-5371
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-23
Original CVE updated
2026-05-13
Advisory published
2017-01-23
Advisory updated
2026-05-13

Who should care

SAP ASE 16 administrators, database/platform owners, and security teams responsible for internet- or intranet-facing OData services should treat this as relevant, especially where service availability is important.

Technical summary

The published description says the OData Server in SAP Adaptive Server Enterprise 16 can be crashed by a remote attacker sending a series of crafted requests. NVD assigns CVSS v3.0 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating a network attack with no privileges or user interaction and a high availability impact. The weakness is categorized as CWE-20 (Improper Input Validation).

Defensive priority

High. The attack surface is network-facing, does not require authentication or user interaction per the CVSS vector, and the primary impact is service availability loss through process termination.

Recommended defensive actions

  • Apply SAP Security Note 2330422 or the vendor-provided fix for SAP ASE 16 OData Server.
  • Identify all SAP Adaptive Server Enterprise 16 instances that expose OData Server functionality and confirm patch status.
  • If immediate patching is not possible, restrict network access to the OData service to trusted hosts and segments only.
  • Monitor for unexpected OData Server crashes, restarts, and related error logs as indicators of attempted abuse or instability.
  • Validate any compensating controls against the specific ASE deployment before relying on exposure reduction alone.

Evidence notes

This debrief is based on the supplied CVE description and the official NVD/CVE records. The record states that the OData Server in SAP Adaptive Server Enterprise (ASE) 16 can be crashed by a remote attacker using crafted requests, and it cites SAP Security Note 2330422. NVD lists the vulnerable CPE as sybase:adaptive_server_enterprise:16.0 and classifies the weakness as CWE-20. Related third-party advisories are linked in the source corpus for additional context.

Official resources

The CVE record was published on 2017-01-23, with related advisory references appearing in January 2017. Use the CVE published date as the disclosure timing reference.