|
|
|
|
| |
Credit:
The information has been provided by AbdulAziz Hariri.
The original article can be found at: http://www.zerodayinitiative.com/advisories/ZDI-11-001/
|
| |
Vulnerable Systems:
* Microsoft Data Access Components
The vulnerability is present in an API call and as such successful exploitation will depend on an application's implementation of this call.
The specific flaw exists within the SQLConnectW call in the odbc32.dll component. When calculating the size of a user provided szDSN, the result of a call to lstrlenW is used in a signed comparison to SQL_MAX_DSN_LENGTH to verify the destination buffer size. This value is later used to copy user supplied data to a fixed length stack buffer. A malicious szDSN length could be used to exploit this signedness bug and execute arbitrary code.
Patch Availability:
Microsoft has issued an update to correct this vulnerability found at Microsoft has issued an update to correct this vulnerability. More details can be found at
http://www.microsoft.com/technet/security/bulletin/MS11-002.mspx
CVE Information:
CVE-2011-0026
Disclosure Timeline:
2010-06-23 - Vulnerability reported to vendor
2011-01-11 - Coordinated public release of advisory
|
|
|
|
|
