Vulnerability CVE-2011-0026 - CERT Civis.Net

Vulnerability Name:

CVE-2011-0026 (CCN-64340)

Assigned:

2010-12-10

Published:

2011-01-11

Updated:

2019-02-26

Summary:

Integer signedness error in the SQLConnectW function in an ODBC API (odbc32.dll) in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2, and Windows Data Access Components (WDAC) 6.0, allows remote attackers to execute arbitrary code via a long string in the Data Source Name (DSN) and a crafted szDSN argument, which bypasses a signed comparison and leads to a buffer overflow, aka "DSN Overflow Vulnerability."

CVSS v3 Severity:

10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Changed
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

9.3 High (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2011-0026

Source: OSVDB
Type: UNKNOWN
70443

Source: CCN
Type: SA42804
Microsoft Data Access Components Two Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
42804

Source: CCN
Type: SECTRACK ID: 1024947
Microsoft Data Access Components (MDAC) Memory Corruption Errors in Processing DSN Data and ADO Records Let Remote Users Execute Arbitrary Code

Source: CONFIRM
Type: UNKNOWN
http://support.avaya.com/css/P8/documents/100124846

Source: CCN
Type: Microsoft Security Bulletin MS11-002
Vulnerabilities in Microsoft Data Access Components Could Allow Remote Code Execution (2451910)

Source: CCN
Type: OSVDB ID: 70443
Microsoft Data Access Components (MDAC / WDAC) ODBC API (odbc32.dll) SQLConnectW Function DSN / szDSN Argument Handling Overflow

Source: BID
Type: UNKNOWN
45695

Source: CCN
Type: BID-45695
Microsoft Data Access Components Data Source Name Buffer Overflow Vulnerability

Source: SECTRACK
Type: UNKNOWN
1024947

Source: CERT
Type: US Government Resource
TA11-011A

Source: VUPEN
Type: UNKNOWN
ADV-2011-0075

Source: MISC
Type: UNKNOWN
http://www.zerodayinitiative.com/advisories/ZDI-11-001/

Source: MS
Type: UNKNOWN
MS11-002

Source: XF
Type: UNKNOWN
mdac-odbc-bo(64340)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:12333

Source: CCN
Type: ZDI-11-001
Microsoft Data Access Components DSN Overflow Code Execution Vulnerability

Vulnerable Configuration:

Configuration 1:

cpe:/a:microsoft:data_access_components:2.8:sp1:*:*:*:*:*:*

AND

cpe:/o:microsoft:windows_xp:*:*:*:*:*:*:*:*

Configuration 2:

cpe:/a:microsoft:data_access_components:2.8:sp2:*:*:*:*:*:*

AND

cpe:/o:microsoft:windows_2003_server:*:sp2:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2003:*:sp2:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp:-:sp2:x64:*:*:*:*:*

Configuration 3:

cpe:/a:microsoft:windows_data_access_components:6.0:*:*:*:*:*:*:*

AND

cpe:/o:microsoft:windows_7:-:*:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:itanium:*

OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:x32:*

OR cpe:/o:microsoft:windows_server_2008:*:*:x64:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x32:*

OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x64:*

OR cpe:/o:microsoft:windows_server_2008:-:sp2:itanium:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2008:r2:*:*:*:*:*:itanium:*

OR cpe:/o:microsoft:windows_server_2008:r2:*:*:*:*:*:x64:*

OR cpe:/o:microsoft:windows_vista:*:sp1:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_vista:*:sp1:x64:*:*:*:*:*

OR cpe:/o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_vista:*:sp2:x64:*:*:*:*:*

Configuration CCN 1:

cpe:/a:microsoft:data_access_components:2.8:sp1:*:*:*:*:*:*

OR cpe:/a:microsoft:data_access_components:2.8:sp2:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:x32:*

OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:itanium:*

AND

cpe:/o:microsoft:windows:server_2003:sp2:*:*:*:*:*:*

OR cpe:/o:microsoft:windows:server_2003:sp2:itanium:*:*:*:*:*

OR cpe:/o:microsoft:windows:server_2003:sp2:x64:*:*:*:*:*

OR cpe:/o:microsoft:windows_xp::sp2:x64:*:professional:*:*:*

OR cpe:/o:microsoft:windows_vista:-:sp1:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_vista:-:sp1:x64:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:itanium:*

OR cpe:/o:microsoft:windows_server_2008:*:*:*:*:*:*:x64:*

OR cpe:/o:microsoft:windows:xp:sp3:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_vista:-:sp2:x64:*:*:*:*:*

OR cpe:/o:microsoft:windows_vista:-:sp2:*:*:*:*:*:*

OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x32:*

OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x64:*

OR cpe:/o:microsoft:windows_7:-:-:*:*:ultimate_n:*:x64:*

OR cpe:/o:microsoft:windows_7:-:*:*:*:*:*:x32:*

OR cpe:/o:microsoft:windows_server_2008:r2:*:*:*:*:*:x64:*

OR cpe:/o:microsoft:windows_server_2008:r2:*:*:*:*:*:itanium:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.mitre.oval:def:12333	V	DSN Overflow Vulnerability	2015-08-10