PatchSiren

PatchSiren cyber security CVE debrief

CVE-2017-5371 Sybase CVE debrief

CVE-2017-5371 is a network-reachable denial-of-service issue in the OData Server component of SAP Adaptive Server Enterprise (ASE) 16. According to the CVE/NVD record, crafted requests can trigger a process crash. The issue is rated High and maps to a validation weakness (CWE-20).

Vendor
Sybase
Product
Adaptive Server Enterprise
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2017-01-23
Original CVE updated
2026-05-13
Advisory published
2017-01-23
Advisory updated
2026-05-13

Who should care

SAP ASE 16 administrators, database/platform owners, and security teams responsible for internet- or intranet-facing OData services should treat this as relevant, especially where service availability is important.

Technical summary

The published description says the OData Server in SAP Adaptive Server Enterprise 16 can be crashed by a remote attacker sending a series of crafted requests. NVD assigns CVSS v3.0 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating a network attack with no privileges or user interaction and a high availability impact. The weakness is categorized as CWE-20 (Improper Input Validation).

Defensive priority

High. The attack surface is network-facing, does not require authentication or user interaction per the CVSS vector, and the primary impact is service availability loss through process termination.

Recommended defensive actions

  • Apply SAP Security Note 2330422 or the vendor-provided fix for SAP ASE 16 OData Server.
  • Identify all SAP Adaptive Server Enterprise 16 instances that expose OData Server functionality and confirm patch status.
  • If immediate patching is not possible, restrict network access to the OData service to trusted hosts and segments only.
  • Monitor for unexpected OData Server crashes, restarts, and related error logs as indicators of attempted abuse or instability.
  • Validate any compensating controls against the specific ASE deployment before relying on exposure reduction alone.

Evidence notes

This debrief is based on the supplied CVE description and the official NVD/CVE records. The record states that the OData Server in SAP Adaptive Server Enterprise (ASE) 16 can be crashed by a remote attacker using crafted requests, and it cites SAP Security Note 2330422. NVD lists the vulnerable CPE as sybase:adaptive_server_enterprise:16.0 and classifies the weakness as CWE-20. Related third-party advisories are linked in the source corpus for additional context.

Sources and references

Verified primary and authoritative sources

  • CVE-2017-5371 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2017-5371

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2017-5371 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2017-5371

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.