An issue in the box_equal function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a SELECT statement.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6879-1 advisory.

    Jingzhou Fu discovered that Virtuoso Open-Source Edition incorrectly handled certain crafted SQL     statements. An attacker could possibly use this issue to crash the program, resulting in a denial of     service. (CVE-2023-31620, CVE-2023-31622, CVE-2023-31624, CVE-2023-31626, CVE-2023-31627, CVE-2023-31629,     CVE-2023-31630, CVE-2023-31631, CVE-2023-48951)

    Jingzhou Fu discovered that Virtuoso Open-Source Edition incorrectly handled certain crafted SQL     statements. An attacker could possibly use this issue to crash the program, resulting in a denial of     service. This issue only affects Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2023-48945, CVE-2023-48946,     CVE-2023-48947, CVE-2023-48950)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This plugin has been deprecated as it does not adhere to established standards for this style of check.

The version of virtuoso-opensource installed on the remote host is prior to 7.2.11-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2383 advisory.

  - An issue in the box_div function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a     Denial of Service (DoS) after running a SELECT statement. (CVE-2023-48948)

  - An issue in the box_add function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a     Denial of Service (DoS) after running a SELECT statement. (CVE-2023-48949)

  - An issue in the box_equal function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a     Denial of Service (DoS) after running a SELECT statement. (CVE-2023-48951)

  - An issue in the box_deserialize_reusing function in openlink virtuoso-opensource v7.2.11 allows attackers     to cause a Denial of Service (DoS) after running a SELECT statement. (CVE-2023-48952)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
201901	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : Virtuoso Open-Source Edition vulnerabilities (USN-6879-1)	Nessus	Ubuntu Local Security Checks	high
195509	RHEL 7 : virtuoso-opensource (Unpatched Vulnerability) (deprecated)	Nessus	Red Hat Local Security Checks	high
187819	Amazon Linux 2 : virtuoso-opensource (ALAS-2024-2383)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2023-48951

high

Tenable Plugins

high

high

high