The SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c in unixODBC 2.3.5 has strncpy arguments in the wrong order, which allows attackers to cause a denial of service or possibly have unspecified other impact.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - unixODBC: Insecure buffer copy in SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c (CVE-2018-7485)

  - The SQLDriverConnect() function in unixODBC before 2.2.14p2 have a possible buffer overflow condition when     specifying a large value for SAVEFILE parameter in the connection string. (CVE-2011-1145)

  - Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and earlier allows local users     to cause a denial of service (crash) via a long string in the FILEDSN option. NOTE: this issue might not     be a vulnerability, since the ability to set this option typically implies that the attacker already has     legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege     boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker,     although it seems likely that other, more serious issues would also be exposed, and this issue might not     cross privilege boundaries in that context. (CVE-2012-2657)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - unixODBC: Insecure buffer copy in SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c (CVE-2018-7485)

  - The SQLDriverConnect() function in unixODBC before 2.2.14p2 have a possible buffer overflow condition when     specifying a large value for SAVEFILE parameter in the connection string. (CVE-2011-1145)

  - Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and earlier allows local users     to cause a denial of service (crash) via a long string in the FILEDSN option. NOTE: this issue might not     be a vulnerability, since the ability to set this option typically implies that the attacker already has     legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege     boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker,     although it seems likely that other, more serious issues would also be exposed, and this issue might not     cross privilege boundaries in that context. (CVE-2012-2657)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2336 advisory.

    [2.3.1-14.0.1]
    - backport unchecked malloc memory references fix [Orabug: 29684195]

    [2.3.1-14]
    - fixed insecure buffer copy (#1571530)
    - fixed possible buffer overflow (#1571528)

    [2.3.1-13]
    - revert: ltdl bundling

    [2.3.1-12]
    - fix the libtool-ltdl compatibility       Resolves: rhbz#1267438

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4999 advisory.

    The unixODBC packages contain a framework that supports accessing databases through the ODBC protocol.

    Security Fix(es):

    * unixODBC: Buffer overflow in unicode_to_ansi_copy() can lead to crash or other unspecified impact     (CVE-2018-7409)

    * unixODBC: Insecure buffer copy in SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c (CVE-2018-7485)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the unixODBC package has been released.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has unixODBC packages installed that are affected by multiple vulnerabilities:

  - The SQLWriteFileDSN function in     odbcinst/SQLWriteFileDSN.c in unixODBC 2.3.5 has strncpy     arguments in the wrong order, which allows attackers to     cause a denial of service or possibly have unspecified     other impact. (CVE-2018-7485)

  - In unixODBC before 2.3.5, there is a buffer overflow in     the unicode_to_ansi_copy() function in     DriverManager/__info.c. (CVE-2018-7409)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the unixODBC packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Install unixODBC if you want to access databases     through ODBC.You will also need the     mysql-connector-odbc package if you want to access a     MySQL database, and/or the postgresql-odbc package for     PostgreSQL.Security Fix(es):The SQLWriteFileDSN     function in odbcinst/SQLWriteFileDSN.c in unixODBC     2.3.5 has strncpy arguments in the wrong order, which     allows attackers to cause a denial of service or     possibly have unspecified other     impact.(CVE-2018-7485)In unixODBC before 2.3.5, there     is a buffer overflow in the unicode_to_ansi_copy()     function in DriverManager/__info.c.(CVE-2018-7409)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the unixODBC packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In unixODBC before 2.3.5, there is a buffer overflow in     the unicode_to_ansi_copy() function in     DriverManager/__info.c.(CVE-2018-7409)

  - The SQLWriteFileDSN function in     odbcinst/SQLWriteFileDSN.c in unixODBC 2.3.5 has     strncpy arguments in the wrong order, which allows     attackers to cause a denial of service or possibly have     unspecified other impact.(CVE-2018-7485)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A buffer overflow flaw was found in the unicode_to_ansi_copy() function of unixODBC. This overflow is not directly controllable by an attacker making the maximum potential impact a crash or denial of service.(CVE-2018-7409)

An argument order confusion flaw was found in the SQLWriteFileDSN API of unixODBC. This could only be exploited via a malicious ODBC database connector package with the maximum impact being a denial of service. (CVE-2018-7485)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has unixODBC packages installed that are affected by multiple vulnerabilities:

  - The SQLWriteFileDSN function in     odbcinst/SQLWriteFileDSN.c in unixODBC 2.3.5 has strncpy     arguments in the wrong order, which allows attackers to     cause a denial of service or possibly have unspecified     other impact. (CVE-2018-7485)

  - In unixODBC before 2.3.5, there is a buffer overflow in     the unicode_to_ansi_copy() function in     DriverManager/__info.c. (CVE-2018-7409)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for unixODBC is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The unixODBC packages contain a framework that supports accessing databases through the ODBC protocol.

Security Fix(es) :

* unixODBC: Buffer overflow in unicode_to_ansi_copy() can lead to crash or other unspecified impact (CVE-2018-7409)

* unixODBC: Insecure buffer copy in SQLWriteFileDSN function in odbcinst/ SQLWriteFileDSN.c (CVE-2018-7485)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

Security Fix(es) :

  - unixODBC: Buffer overflow in unicode_to_ansi_copy() can     lead to crash or other unspecified impact     (CVE-2018-7409)

  - unixODBC: Insecure buffer copy in SQLWriteFileDSN     function in odbcinst/SQLWriteFileDSN.c (CVE-2018-7485)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:2336 advisory.

    The unixODBC packages contain a framework that supports accessing databases through the ODBC protocol.

    Security Fix(es):

    * unixODBC: Buffer overflow in unicode_to_ansi_copy() can lead to crash or other unspecified impact     (CVE-2018-7409)

    * unixODBC: Insecure buffer copy in SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c (CVE-2018-7485)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

update to version 2.3.7

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for unixODBC to version 2.3.6 fixes the following issues :

  - CVE-2018-7409: Buffer overflow in unicode_to_ansi_copy()     was fixed in 2.3.5 (bsc#1082290)

  - CVE-2018-7485: Swapped arguments in SQLWriteFileDSN() in     odbcinst/SQLWriteFileDSN.c (bsc#1082484)

Other fixes :

  - Enabled --enable-fastvalidate option in configure     (bsc#1044970)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for unixODBC to version 2.3.6 fixes the following issues :

  - CVE-2018-7409: Buffer overflow in unicode_to_ansi_copy()     was fixed in 2.3.5 (bsc#1082290)

  - CVE-2018-7485: Swapped arguments in SQLWriteFileDSN() in     odbcinst/SQLWriteFileDSN.c (bsc#1082484) Other fixes :

  - Enabled --enable-fastvalidate option in configure     (bsc#1044970)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
199429	RHEL 6 : unixodbc (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
199427	RHEL 5 : unixodbc (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
196112	RHEL 6 : unixodbc (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
196096	RHEL 5 : unixodbc (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	critical
180875	Oracle Linux 7 : unixODBC (ELSA-2019-2336)	Nessus	Oracle Linux Local Security Checks	critical
142675	RHEL 7 : unixODBC (RHSA-2020:4999)	Nessus	Red Hat Local Security Checks	critical
136336	Photon OS 2.0: Unixodbc PHSA-2020-2.0-0235	Nessus	PhotonOS Local Security Checks	critical
132448	NewStart CGSL CORE 5.05 / MAIN 5.05 : unixODBC Multiple Vulnerabilities (NS-SA-2019-0241)	Nessus	NewStart CGSL Local Security Checks	critical
131647	EulerOS 2.0 SP2 : unixODBC (EulerOS-SA-2019-2494)	Nessus	Huawei Local Security Checks	critical
130729	EulerOS 2.0 SP3 : unixODBC (EulerOS-SA-2019-2267)	Nessus	Huawei Local Security Checks	critical
130605	Amazon Linux 2 : unixODBC (ALAS-2019-1354)	Nessus	Amazon Linux Local Security Checks	critical
129891	NewStart CGSL CORE 5.04 / MAIN 5.04 : unixODBC Multiple Vulnerabilities (NS-SA-2019-0195)	Nessus	NewStart CGSL Local Security Checks	critical
128392	CentOS 7 : unixODBC (CESA-2019:2336)	Nessus	CentOS Local Security Checks	critical
128268	Scientific Linux Security Update : unixODBC on SL7.x x86_64 (20190806)	Nessus	Scientific Linux Local Security Checks	critical
127714	RHEL 7 : unixODBC (RHSA-2019:2336)	Nessus	Red Hat Local Security Checks	critical
120631	Fedora 28 : unixODBC (2018-9565c0bc9a)	Nessus	Fedora Local Security Checks	critical
110829	openSUSE Security Update : unixODBC (openSUSE-2018-684)	Nessus	SuSE Local Security Checks	critical
110764	SUSE SLED12 / SLES12 Security Update : unixODBC (SUSE-SU-2018:1832-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2018-7485

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical