Vulnerability record · CVE-2005-2297 · published 19 July 2005
CVE-2005-2297: Sybase EAServer TreeAction.do stack buffer overflow
Sybase · Easerver
TreeAction.do in Sybase EAServer 4.2.5 through 5.2 contains a stack-based buffer overflow reachable through an oversized javascript parameter. A remote authenticated user can corrupt the stack and potentially execute arbitrary code on the server. The record is old and thin, with no CWE mapping beyond 'Other' and no exploit code referenced.
Description
Stack-based buffer overflow in TreeAction.do in Sybase EAServer 4.2.5 through 5.2 allows remote authenticated users to execute arbitrary code via a large javascript parameter.
AV:L/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityRemote authenticated code execution in an application server is serious, and EPSS is very high, though the absence of KEV listing and public exploit tags keeps it below critical.
What it is
TreeAction.do in Sybase EAServer 4.2.5 through 5.2 contains a stack-based buffer overflow reachable through an oversized javascript parameter. A remote authenticated user can corrupt the stack and potentially execute arbitrary code on the server. The record is old and thin, with no CWE mapping beyond 'Other' and no exploit code referenced.
Impact
An attacker who can authenticate can overwrite stack memory and potentially run arbitrary code in the EAServer process context, leading to full compromise of the application server. Even without reliable code execution, the overflow can crash the service.
Attack surface
The flaw is reached through the TreeAction.do endpoint via a crafted javascript parameter. The description states remote authenticated users, so valid credentials are required; no user interaction is indicated. The CVSS 2.0 vector is AV:L, which conflicts with the remote description and should be treated with caution.
Exploitation
Not listed in CISA KEV and no ransomware associations. EPSS is high (0.742, 99.5th percentile), but reference tags only show Patch and Vendor Advisory, with no public exploit or PoC tagged.
What to do
- Apply the vendor patch referenced in the Sybase advisory (sybase.com/detail?id=1036742) and the SPI Dynamics advisory.
- Upgrade EAServer beyond the affected 4.2.5 through 5.2 range if a fixed release is available.
- Restrict network access to TreeAction.do and the EAServer administrative interfaces to trusted networks.
- Enforce least privilege on EAServer accounts and monitor for unexpected authenticated sessions.
- If patching is delayed, deploy input validation or a WAF rule limiting the size of the javascript parameter.
Detection
- Monitor EAServer logs for crashes or abnormal terminations in the TreeAction.do handler.
- Alert on unusually large javascript parameter values in requests to TreeAction.do.
- Watch for post-exploitation behavior such as new processes spawned by the EAServer service account.
- Correlate authenticated sessions with anomalous request patterns to TreeAction.do.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2005-2297 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2005-2297), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
