CVE-2012-2658

CVSS V2 Low 2.1 CVSS V3 None
Description
** DISPUTED ** Buffer overflow in the SQLDriverConnect function in unixODBC 2.3.1 allows local users to cause a denial of service (crash) via a long string in the DRIVER option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.
Overview
  • CVE ID
  • CVE-2012-2658
  • Assigner
  • secalert@redhat.com
  • Vulnerability Status
  • Modified
  • Published Version
  • 2012-08-31T18:55:01
  • Last Modified Date
  • 2023-02-12T20:15:14
Weakness Enumerations
CWE URL
CWE-119 http://cwe.mitre.org/data/definitions/119.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:unixodbc:unixodbc:2.3.1:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:L/AC:L/Au:N/C:N/I:N/A:P
  • Access Vector
  • LOCAL
  • Access Compatibility
  • LOW
  • Authentication
  • NONE
  • Confidentiality Impact
  • NONE
  • Integrity Impact
  • NONE
  • Availability Impact
  • PARTIAL
  • Base Score
  • 2.1
  • Severity
  • LOW
  • Exploitability Score
  • 3.9
  • Impact Score
  • 2.9
References
Reference URL Reference Tags
http://www.securityfocus.com/bid/53712
http://www.openwall.com/lists/oss-security/2012/05/30/7
http://www.openwall.com/lists/oss-security/2012/05/31/2
http://www.openwall.com/lists/oss-security/2012/05/29/10
http://www.openwall.com/lists/oss-security/2012/06/06/3
http://www.osvdb.org/82460
http://www.openwall.com/lists/oss-security/2012/05/29/7
https://exchange.xforce.ibmcloud.com/vulnerabilities/75940
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2012-2658
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-2658
History
Created Old Value New Value Data Type Notes
2022-05-10 08:49:43 Added to TrackCVE
2023-02-12 21:03:51 2023-02-12T20:15:14 CVE Modified Date updated
2023-02-12 21:03:52 ** DISPUTED ** Buffer overflow in the SQLDriverConnect function in unixODBC 2.3.1 allows local users to cause a denial of service (crash) via a long string in the DRIVER option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context. ** DISPUTED ** Buffer overflow in the SQLDriverConnect function in unixODBC 2.3.1 allows local users to cause a denial of service (crash) via a long string in the DRIVER option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context. Description updated