ArchLinuxASA-201802-14[ASA-201802-14] unixodbc: arbitrary code execution
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.003 Low
EPSS
Percentile
70.5%
Arch Linux Security Advisory ASA-201802-14
Severity: High
Date : 2018-02-23
CVE-ID : CVE-2018-7409
Package : unixodbc
Type : arbitrary code execution
Remote : Yes
Link : https://security.archlinux.org/AVG-627
Summary
The package unixodbc before version 2.3.5-1 is vulnerable to arbitrary
code execution.
Resolution
Upgrade to 2.3.5-1.
pacman -Syu “unixodbc>=2.3.5-1”
The problem has been fixed upstream in version 2.3.5.
Workaround
None.
Description
In unixODBC before 2.3.5, there is a buffer overflow in the
unicode_to_ansi_copy() function in DriverManager/__info.c possibly
leading to arbitrary code execution.
Impact
A remote attacker is able to execute arbitrary code on the affected
host.
References
Related
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.003 Low
EPSS
Percentile
70.5%