The SQLDriverConnect() function in unixODBC before 2.2.14p2 have a possible buffer overflow condition when specifying a large value for SAVE

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• debian debian linux10.0
• debian debian linux8.0
• debian debian linux9.0
• opensuse opensuse11.3
• opensuse opensuse11.4
• redhat enterprise linux4.0
• redhat enterprise linux5.0
• redhat enterprise linux6.0
• unixodbc unixodbcup to 2.2.14 inclusive

Versions reported by the vendor

Affected version ranges reported by the assigning authority (redhat). Independent of NVD's CPE analysis and usually ahead of it.

• unixodbc unixodbc

  • before 2.2.14p2affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2018-7485The SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c in unixODBC 2.3.5 has strncpy arguments in the wrong order, which allows attacker
  40Plan
• CVE-2018-7409In unixODBC before 2.3.5, there is a buffer overflow in the unicode_to_ansi_copy() function in DriverManager/__info.c.
  40Plan
• CVE-2024-1013Unixodbc: out of bounds stack write due to pointer-to-integer types conversion
  31Monitor
• CVE-2012-2658Buffer overflow in the SQLDriverConnect function in unixODBC 2.3.1 allows local users to cause a denial of service (crash) via a long string
  8Monitor
• CVE-2012-2657Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and earlier allows local users to cause a denial of service (cra
  8Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

When data is copied, the source length is not compared with the size of the destination buffer. Excess data overwrites adjacent memory.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1char buf[256];2memcpy(buf, pkt->data, pkt->len);

1char buf[256];2if (pkt->len > sizeof(buf)) {3  return -EINVAL;4}5memcpy(buf, pkt->data, pkt->len);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.