Buffer overflow in the SQLDriverConnect function in unixODBC 2.3.1 allows local users to…
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Partial
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.
Summary
Buffer overflow in the SQLDriverConnect function in unixODBC 2.3.1 allows local users to cause a denial of service (crash) via a long string in the DRIVER option. NOTE: this issue might not be a vulnerability, since the ability to set this option typically implies that the attacker already has legitimate access to cause a DoS or execute code, and therefore the issue would not cross privilege boundaries. There may be limited attack scenarios if isql command-line options are exposed to an attacker, although it seems likely that other, more serious issues would also be exposed, and this issue might not cross privilege boundaries in that context.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
Not affected: 3 products
- Red Hat Enterprise Linux 4
- Red Hat Enterprise Linux 5
- Red Hat Enterprise Linux 6
Timeline
- 2026-10-02 Threatist record created from CVE-2012-2658
- 2026-10-03 Alias added: GHSA-8mx7-qh9r-7vj7
References
Other 6
- 82460
- [oss-security] 20120605 Re: CVE id request: Multiple buffer overflow in unixODBC
- [oss-security] 20120530 Re: CVE id request: Multiple buffer overflow in unixODBC
- [oss-security] 20120531 Re: CVE id request: Multiple buffer overflow in unixODBC
- [oss-security] 20120529 Re: CVE id request: Multiple buffer overflow in unixODBC
- [oss-security] 20120529 CVE id request: Multiple buffer overflow in unixODBC
More Unixodbc vulnerabilities
- TI-2018-05395 The SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c in unixODBC 2.3.5 has strncpy… CVSS 3.0CRITICAL 9.8
- TI-2018-05347 In unixODBC before 2.3.5, there is a buffer overflow in the unicode_to_ansi_copy() function in DriverManager/__info.c. CVSS 3.0CRITICAL 9.8
- TI-2024-00936 Unixodbc: out of bounds stack write due to pointer-to-integer types conversion CVSS 3.1HIGH 7.8
- TI-2011-00998 Buffer overflow in unixodbc CVSS 3.1HIGH 7.8
- TI-2012-02295 Buffer overflow in the SQLDriverConnect function in unixODBC 2.0.10, 2.3.1, and earlier… CVSS 2.0LOW 2.1
Sources
- CVE-2012-2658 · CVE Program
- CVE-2012-2658 · NVD
- FIRST EPSS
- GHSA-8mx7-qh9r-7vj7 · GitHub Advisory Database · CC BY 4.0
- CVE-2012-2658 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences