CVE-2018-7485 (published 2018-02-26T14:29Z)

The SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c in unixODBC 2.3.5 has strncpy arguments in the wrong order, which allows attackers to cause a denial of service or possibly have unspecified other impact.

Severity: HIGH
CVSS v2 base score: 7.5 (AV:N/AC:L/Au:N/C:P/I:P/A:P)
CVSS v3 base score: 9.8, CRITICAL (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-119
cwe_name: Improper Restriction of Operations within the Bounds of a Memory Buffer
description: The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
extended_description: 
            Certain languages allow direct addressing of memory locations and do not automatically ensure that these locations are valid for the memory buffer that is being referenced. This can cause read or write operations to be performed on memory locations that may be associated with other variables, data structures, or internal program data.
         
         

Fix information:
repo_url: https://github.com/lurcher/unixODBC
commit_details: repo_url: https://github.com/lurcher/unixODBC
author: Nick Gorham
author_date: 2018-01-08 11:12:39+00:00
msg: New Pre Source
repository: repo_url: https://github.com/lurcher/unixODBC
repo_name: lurcher/unixODBC
description: The unixODBC Project goals are to develop and promote unixODBC to be the definitive standard for ODBC on non MS Windows platforms.
repo_language: C
owner: lurcher
file_changes: filename: ChangeLog
change_type: ModificationType.MODIFY
diff: @@ -1,3 +1,7 @@
+2.3.6pre
+
+    * Fix order of arguments in SQLWriteFileDSN.c, fix unwanted free() in iusql.c
+
 2-Jan-2018
 2.3.5
 

programming_language: C#
filename: SQLGetDiagRecW.c
change_type: ModificationType.MODIFY
diff: @@ -98,6 +98,8 @@
 
 static char const rcsid[]= "$RCSfile: SQLGetDiagRecW.c,v $";
 
+extern int __is_env( EHEAD * head );        /* in SQLGetDiagRec.c */
+
 static SQLRETURN extract_sql_error_rec_w( EHEAD *head,
         SQLWCHAR *sqlstate,
         SQLINTEGER rec_number,

programming_language: C
filename: SQLSetDescField.c
change_type: ModificationType.MODIFY
diff: @@ -306,7 +306,7 @@ SQLRETURN SQLSetDescField( SQLHDESC descriptor_handle,
         return function_return_nodrv( SQL_HANDLE_DESC, descriptor, SQL_ERROR );
     }
 
-    if ( field_identifier == SQL_DESC_COUNT && (SQLINTEGER)value < 0 )
+    if ( field_identifier == SQL_DESC_COUNT && (intptr_t)value < 0 )
     {
         __post_internal_error( &descriptor -> error,
                 ERROR_07009, NULL,
@@ -315,9 +315,9 @@ SQLRETURN SQLSetDescField( SQLHDESC descriptor_handle,
         return function_return_nodrv( SQL_HANDLE_DESC, descriptor, SQL_ERROR );
     }
     
-    if ( field_identifier == SQL_DESC_PARAMETER_TYPE && value != SQL_PARAM_INPUT
-        && value != SQL_PARAM_OUTPUT && value != SQL_PARAM_INPUT_OUTPUT &&
-        value != SQL_PARAM_INPUT_OUTPUT_STREAM && value != SQL_PARAM_OUTPUT_STREAM )
+    if ( field_identifier == SQL_DESC_PARAMETER_TYPE && (intptr_t)value != SQL_PARAM_INPUT
+        && (intptr_t)value != SQL_PARAM_OUTPUT && (intptr_t)value != SQL_PARAM_INPUT_OUTPUT &&
+        (intptr_t)value != SQL_PARAM_INPUT_OUTPUT_STREAM && (intptr_t)value != SQL_PARAM_OUTPUT_STREAM )
     {
         __post_internal_error( &descriptor -> error,
                 ERROR_HY105, NULL,

programming_language: C
filename: SQLSetDescFieldW.c
change_type: ModificationType.MODIFY
diff: @@ -288,7 +288,7 @@ SQLRETURN SQLSetDescFieldW( SQLHDESC descriptor_handle,
         return function_return_nodrv( SQL_HANDLE_DESC, descriptor, SQL_ERROR );
     }
 
-    if ( field_identifier == SQL_DESC_COUNT && (SQLINTEGER)value < 0 )
+    if ( field_identifier == SQL_DESC_COUNT && (intptr_t)value < 0 )
     {
         __post_internal_error( &descriptor -> error,
                 ERROR_07009, NULL,
@@ -297,9 +297,9 @@ SQLRETURN SQLSetDescFieldW( SQLHDESC descriptor_handle,
         return function_return_nodrv( SQL_HANDLE_DESC, descriptor, SQL_ERROR );
     }
 
-    if ( field_identifier == SQL_DESC_PARAMETER_TYPE && value != SQL_PARAM_INPUT
-        && value != SQL_PARAM_OUTPUT && value != SQL_PARAM_INPUT_OUTPUT &&
-        value != SQL_PARAM_INPUT_OUTPUT_STREAM && value != SQL_PARAM_OUTPUT_STREAM )
+    if ( field_identifier == SQL_DESC_PARAMETER_TYPE && (intptr_t)value != SQL_PARAM_INPUT
+        && (intptr_t)value != SQL_PARAM_OUTPUT && (intptr_t)value != SQL_PARAM_INPUT_OUTPUT &&
+        (intptr_t)value != SQL_PARAM_INPUT_OUTPUT_STREAM && (intptr_t)value != SQL_PARAM_OUTPUT_STREAM )
     {
         __post_internal_error( &descriptor -> error,
                 ERROR_HY105, NULL,

programming_language: C
filename: configure.ac
change_type: ModificationType.MODIFY
diff: @@ -1,6 +1,6 @@
 dnl Process this file with autoconf to produce a configure script.
 
-AC_INIT([unixODBC], [2.3.5], nick@unixodbc.org, [unixODBC])
+AC_INIT([unixODBC], [2.3.6pre], nick@unixodbc.org, [unixODBC])
 AM_INIT_AUTOMAKE
 
 dnl Checks for programs.

programming_language: Shell
filename: iusql.c
change_type: ModificationType.MODIFY
diff: @@ -413,7 +413,6 @@ static int ExecuteSQL( SQLHDBC hDbc, char *szSQL, char cDelimiter, int bColumnNa
             if ( bVerbose ) DumpODBCLog( hEnv, hDbc, hStmt );
             fprintf( stderr, "[ISQL]ERROR: Could not SQLExecDirect\n" );
             SQLFreeStmt( hStmt, SQL_DROP );
-            free(szSepLine);
             return 0;
         }
     }

programming_language: C
filename: SQLCreateDataSource.c
change_type: ModificationType.MODIFY
diff: @@ -26,7 +26,7 @@ char* _multi_string_alloc_and_copy( LPCWSTR in )
 
     if ( !in )
     {
-        return in;
+        return NULL;
     }
 
     while ( in[ len ] != 0 || in[ len + 1 ] != 0 )
@@ -55,7 +55,7 @@ char* _single_string_alloc_and_copy( LPCWSTR in )
 
     if ( !in )
     {
-        return in;
+        return NULL;
     }
 
     while ( in[ len ] != 0 )
@@ -83,7 +83,7 @@ SQLWCHAR* _multi_string_alloc_and_expand( LPCSTR in )
 
     if ( !in )
     {
-        return in;
+        return NULL;
     }
     
     while ( in[ len ] != 0 || in[ len + 1 ] != 0 )
@@ -112,7 +112,7 @@ SQLWCHAR* _single_string_alloc_and_expand( LPCSTR in )
 
     if ( !in )
     {
-        return in;
+        return NULL;
     }
 
     while ( in[ len ] != 0 )

programming_language: C
filename: SQLWriteFileDSN.c
change_type: ModificationType.MODIFY
diff: @@ -21,7 +21,7 @@ BOOL SQLWriteFileDSN(			LPCSTR	pszFileName,
 
 	if ( pszFileName[0] == '/' )
 	{
-		strncpy( szFileName, sizeof(szFileName) - 5, pszFileName );
+		strncpy( szFileName, pszFileName, sizeof(szFileName) - 5 );
 	}
 	else
 	{	

programming_language: C++