oss-security - Re: CVE id request: Multiple buffer overflow in unixODBC

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CA+5g0S+0PHoU8Pdnewj5XS+WvvnUxgEkOd=dZjpuGB6soGB7GA@mail.gmail.com>
Date: Wed, 30 May 2012 14:40:06 -0300
From: Felipe Pena <felipensp@...il.com>
To: Kurt Seifried <kseifried@...hat.com>
Cc: oss-security@...ts.openwall.com, Tomas Hoger <thoger@...hat.com>
Subject: Re: CVE id request: Multiple buffer overflow in unixODBC

Hi all,

2012/5/30 Kurt Seifried <kseifried@...hat.com>:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> On 05/30/2012 02:07 AM, Tomas Hoger wrote:
>> On Tue, 29 May 2012 09:42:42 -0300 Felipe Pena wrote:
>>
>>> Multiple buffer overflow in unixODBC ===========================
>>>
>>> The library unixODBC doesn't check properly the input from
>>> FILEDSN=, DRIVER= options in the DSN, which causes buffer
>>> overflow when passed to the SQLDriverConnect() function.
>>
>> Reports like this - covering bugs in parsing of the configuration
>> parameters (i.e. generally trusted input) - should include some
>> reasoning why these should be considered security.  Nothing obvious
>> not intended to break PHP safe_mode comes to mind.
>>
>
> Ahh my bad, I misunderstood this to be options that could be passed by
> the program as a standard part of the query, and thus controlled by
> the attacker. If this is indeed limited to configuration files and
> there are not extenuating circumstances that allow exploitation I will
> have to REJECT these CVEs.
>

It isn't limited to the configuration files. Such input can be passed
to the `isql' interactive tool that come together unixODBC. The same
string can be used to connect through PHP PDO, for example.

$ pwd
.../unixodbc/src/unixODBC-2.3.1/exe
$ ./isql "FILEDSN=$(python -c "print 'A'*10000");UID=user" -k
Segmentation fault

If it isn't characterized a security issue I'm sorry.

Thanks.

-- 
Regards,
Felipe Pena

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.