CVE-2012-2657

DISPUTED Buffer overflow in the SQLDriverConnect function in unixODBC
2.0.10, 2.3.1, and earlier allows local users to cause a denial of service
(crash) via a long string in the FILEDSN option. NOTE: this issue might not
be a vulnerability, since the ability to set this option typically implies
that the attacker already has legitimate access to cause a DoS or execute
code, and therefore the issue would not cross privilege boundaries. There
may be limited attack scenarios if isql command-line options are exposed to
an attacker, although it seems likely that other, more serious issues would
also be exposed, and this issue might not cross privilege boundaries in
that context.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=675058&gt;

Notes