Vulnerable Systems:
* Borland idsql32.dll version 5.1.0.4 (as used by RevilloC MailServer)
* Borland idsql32.dll version 5.2.0.2 as included with Borland Developer Studio 2006
The vulnerability is caused due to a boundary error in idsql32.dll when processing SQL statements using the "DbiQExec()" function. This can be exploited to cause a heap-based buffer overflow via an overly long SQL statement (more than 4000 bytes).
Solution:
Restrict access to applications and services using the vulnerable library.
Applications using the vulnerable function should check the length of the user input before creating an SQL statement and using it in a query.
Time Table:
15/11/2006 - Vendor notified.
27/11/2006 - Vendor reminder sent.
29/11/2006 - Public disclosure.
