unixODBC <=2.3.14 vulnerable to rude truncation causing out-of-bounds memcpy
Original title: unixODBC <=2.3.14 Rude Truncation via Narrowing Conversion Causes Out-of-Bounds `memcpy`
Rude truncation of 64-bit SQLLEN buffer_length to 32-bit int in unixODBC <=2.3.14 enables potential out-of-bounds memory writes.
unixODBC versions <=2.3.14 contain rude truncation of a 64-bit SQLLEN buffer_length to a 32-bit int without verifying that it produces a valid positive value. The result is later passed to memcpy, causing the information system to crash or enabling attackers to write adjacent memory under certain circumstances.
- Rude truncation of 64-bit buffer_length to 32-bit int
- Passed to memcpy causing out-of-bounds writes
- Can lead to crashes or memory corruption
- Affects versions <=2.3.14
Impact: out-of-bounds memory write via buffer truncation
- Vendors
- unixODBC
From the original article
Posted by Daniel Owens via Fulldisclosure on Nov 04 unixODBC versions <=2. 3. 14 contain a rude truncation of a 64-bit `SQLLEN` `buffer_length` to a 32-bit `int` without verifying that it produces a valid, positive value.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.