Headline
CVE-2012-2657: security - Re: CVE id request: Multiple buffer overflow in unixODBC
** DISPUTED ** Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and earlier allows local users to cause a denial of service (crash) via a long string in the FILEDSN option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.
- Products
- Openwall GNU/*/Linux server OS
- Linux Kernel Runtime Guard
- John the Ripper password cracker
- Free & Open Source for any platform
- in the cloud
- Pro for Linux
- Pro for macOS
- Wordlists for password cracking
- passwdqc policy enforcement
- Free & Open Source for Unix
- Pro for Windows (Active Directory)
- yescrypt KDF & password hashing
- yespower Proof-of-Work (PoW)
- crypt_blowfish password hashing
- phpass ditto in PHP
- tcb better password shadowing
- Pluggable Authentication Modules
- scanlogd port scan detector
- popa3d tiny POP3 daemon
- blists web interface to mailing lists
- msulogin single user mode login
- php_mt_seed mt_rand() cracker
- Services
- Publications
- Articles
- Presentations
- Resources
- Mailing lists
- Community wiki
- Source code repositories (GitHub)
- Source code repositories (CVSweb)
- File archive & mirrors
- How to verify digital signatures
- OVE IDs
- What’s new
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 31 May 2012 16:44:24 +0200 From: Tomas Hoger <thoger@…hat.com> To: oss-security@…ts.openwall.com Cc: Kurt Seifried <kseifried@…hat.com>, Felipe Pena <felipensp@…il.com> Subject: Re: CVE id request: Multiple buffer overflow in unixODBC
On Wed, 30 May 2012 13:02:53 -0600 Kurt Seifried wrote:
On 05/30/2012 11:40 AM, Felipe Pena wrote:
It isn’t limited to the configuration files. Such input can be passed to the `isql’ interactive tool that come together unixODBC. The same string can be used to connect through PHP PDO, for example.
Agree, anything that parses such connect string can be crashed this way. The question is if any trust boundary is crossed with that, which depends on whether there are any apps that allow untrusted connect strings.
$ ./isql “FILEDSN=$(python -c “print 'A’*10000”);UID=user” -k
Anyone having shell access to run isql directly should be assumed to have ability to edit ~/.odbcinst.ini, which should be enough to crash isql or inject code to it without having to trigger one of the mentioned overflows.
Is this something that an attacker can typically control, or does the PHP author need to write code that does this?
For PHP applications, would you assume attacker can typically control settings as database name, host, port or username? It’s not really quite common. Possible use cases that come to mind:
- DB management application similar to phpMyAdmin, that may take some DB connection info as input from user. If something like that exists for ODBC, another question would be if the info from user can actually be used to sneak in values for FILEDSN or DRIVER.
- Of course, this may allow safe_mode bypass, which may not be possible via odbcinst.ini (e.g. PHP script may not be allowed to edit it and safe_mode does not allow setting ODBCINSTINI environment variable).
– Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.