PT-2019-6619 · Unixodbc · Unixodbc

Felipe Pena · Publicado 2017-10-16 · Atualizado 2024-06-15 · CVE-2011-1145

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions unixODBC versions prior to 2.2.14p2

Description The issue is related to a possible buffer overflow condition in the SQLDriverConnect() function when a large value is specified for the SAVEFILE parameter in the connection string. This condition can occur when using the SQLDriverConnect() function with a large SAVEFILE value.

Recommendations For versions prior to 2.2.14p2, update to version 2.2.14p2 or later to resolve the issue. As a temporary workaround, consider restricting the use of large values for the SAVEFILE parameter in the connection string to minimize the risk of exploitation.

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-120

Identificadores relacionados

CVE-2011-1145

OPENSUSE-SU-2024:10413-1

Produtos afetados

Unixodbc

Referências · 10

• https://t.me/cibsecurity/8211 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2011-1145 · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2011-1145 · Aviso do Fabricante
• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2011-1145 · Nota
• https://security-tracker.debian.org/tracker/CVE-2011-1145 · Aviso do Fabricante
• https://osv.dev/vulnerability/openSUSE-SU-2024:10413-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2011-1145 · Nota
• https://osv.dev/vulnerability/CVE-2011-1145 · Aviso do Fabricante
• https://access.redhat.com/security/cve/cve-2011-1145 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2011-1145 · Nota