Memory corruption in unixODBC - CVE-2018-7485

Vulnerability identifier: #VU11172

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-7485

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote unauthenticated attacker to cause DoS condition on the target system.

The weakness exists in the SQLWriteFileDSN function due to boundary error. A remote attacker can trigger memory corruption and cause the service to crash.

unixODBC
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux Server - TUS
Fedora
openSUSE Leap
unixODBC (Red Hat package)
unixODBC

Install update from vendor's website.

unixODBC (Red Hat package) - update to 2.3.1-14.el7_6
unixODBC - addressed in versions 2.3.7-1.fc27, 2.3.7-1.fc28

• https://github.com/lurcher/unixODBC/commit/45ef78e037f578b15fc58938a3a3251655e71d6f#diff-d52750c7ba4...

• Denial of service in unixODBC
• OpenSUSE Linux update for unixODBC
• Red Hat update for unixODBC
• Red Hat Enterprise Linux 7.6 update for unixODBC
• Fedora 27 update for unixODBC
• Fedora 28 update for unixODBC