[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20120531164424.3151f7d9@redhat.com>
Date: Thu, 31 May 2012 16:44:24 +0200
From: Tomas Hoger <thoger@...hat.com>
To: oss-security@...ts.openwall.com
Cc: Kurt Seifried <kseifried@...hat.com>, Felipe Pena <felipensp@...il.com>
Subject: Re: CVE id request: Multiple buffer overflow in
unixODBC
On Wed, 30 May 2012 13:02:53 -0600 Kurt Seifried wrote:
> On 05/30/2012 11:40 AM, Felipe Pena wrote:
>
> > It isn't limited to the configuration files. Such input can be
> > passed to the `isql' interactive tool that come together unixODBC.
> > The same string can be used to connect through PHP PDO, for
> > example.
Agree, anything that parses such connect string can be crashed this
way. The question is if any trust boundary is crossed with that, which
depends on whether there are any apps that allow untrusted connect
strings.
> > $ ./isql "FILEDSN=$(python -c "print 'A'*10000");UID=user" -k
Anyone having shell access to run isql directly should be assumed to
have ability to edit ~/.odbcinst.ini, which should be enough to crash
isql or inject code to it without having to trigger one of the
mentioned overflows.
> Is this something that an attacker can typically control, or does the
> PHP author need to write code that does this?
For PHP applications, would you assume attacker can typically control
settings as database name, host, port or username? It's not really
quite common. Possible use cases that come to mind:
- DB management application similar to phpMyAdmin, that may take some
DB connection info as input from user. If something like that exists
for ODBC, another question would be if the info from user can
actually be used to sneak in values for FILEDSN or DRIVER.
- Of course, this may allow safe_mode bypass, which may not be possible
via odbcinst.ini (e.g. PHP script may not be allowed to edit it and
safe_mode does not allow setting ODBCINSTINI environment variable).
--
Tomas Hoger / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
