Bug 23253 - unixODBC new security issues CVE-2018-7409 and CVE-2018-7485
Summary: unixODBC new security issues CVE-2018-7409 and CVE-2018-7485
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 6
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA6-64-OK
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2018-06-29 20:04 CEST by David Walser
Modified: 2018-09-21 18:27 CEST (History)
7 users (show)

See Also:
Source RPM: unixODBC-2.3.4-2.mga6.src.rpm
CVE:
Status comment: Fixed upstream in 2.3.6


Attachments

Description David Walser 2018-06-29 20:04:49 CEST
openSUSE has issued an advisory today (June 29):
https://lists.opensuse.org/opensuse-updates/2018-06/msg00144.html

The issues are fixed upstream in 2.3.6.

Mageia 5 and Mageia 6 are also affected.
David Walser 2018-06-29 20:05:19 CEST

Status comment: (none) => Fixed upstream in 2.3.6

Comment 1 Marja Van Waes 2018-06-29 20:33:44 CEST
Assigning to the registered maintainer.

CC: (none) => marja11
Assignee: bugsquad => makowski.mageia

Comment 2 David Walser 2018-09-07 19:37:37 CEST
Fedora has issued an advisory for this today (September 7):
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/FNQ5MBIGSDZTV3C7TRG7BMA6GMVJVOYO/

They updated to 2.3.7.
Comment 3 David GEIGER 2018-09-10 20:18:49 CEST
Already fixed for Cauldron and now also fixed for mga6 updating to latest 2.3.7 release!

Note that the unneeded static devel pkg was removed!

CC: (none) => geiger.david68210

Comment 4 David Walser 2018-09-12 22:45:24 CEST
Advisory:
========================

Updated unixODBC packages fix security vulnerabilities:

unixODBC before version 2.3.5 is vulnerable to a buffer overflow in the
DriverManager/__info.c:unicode_to_ansi_copy() method. An attacker could exploit
this to cause a denial of service or other unspecified impact (CVE-2018-7409).

The SQLWriteFileDSN function in odbcinst/SQLWriteFileDSN.c in unixODBC 2.3.5 has
strncpy arguments in the wrong order, which allows attackers to cause a denial
of service or possibly have unspecified other impact (CVE-2018-7485).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7409
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7485
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/FNQ5MBIGSDZTV3C7TRG7BMA6GMVJVOYO/
========================

Updated packages in core/updates_testing:
========================
unixODBC-2.3.7-1.mga6
libunixODBC2-2.3.7-1.mga6
libunixODBC-devel-2.3.7-1.mga6

from unixODBC-2.3.7-1.mga6.src.rpm

Assignee: makowski.mageia => qa-bugs
Severity: normal => major

Comment 5 Herman Viaene 2018-09-14 15:00:52 CEST
MGA6-32 MATE on IBM ThinkpadR50e
No installation issues.
Googling to find some easy use case, but not much success (it's a long time ago I used ODBC....)
Tried CLI:
$ odbcinst --version
unixODBC 2.3.7
$ odbcinst

**********************************************
* unixODBC - odbcinst                        *
**********************************************
*                                            *
* Purpose:                                   *
*                                            *
*      An ODBC Installer and Uninstaller.    *
*      Updates system files, and             *
*      increases/decreases usage counts but  *
*      does not actually copy or remove any  *
*      files.                          
and more
$ odbcinst -j
unixODBC 2.3.7
DRIVERS............: /etc/odbcinst.ini
SYSTEM DATA SOURCES: /etc/odbc.ini
FILE DATA SOURCES..: /etc/ODBCDataSources
USER DATA SOURCES..: /home/tester6/.odbc.ini
SQLULEN Size.......: 4
SQLLEN Size........: 4
SQLSETPOSIROW Size.: 2

As nothing ODBC is installed, the above files are empty, seems OK

CC: (none) => herman.viaene

Comment 6 Len Lawrence 2018-09-20 15:53:24 CEST
Mageia 6, x86_64

Checked installation then updated.

New to me so just copied Herman's commands.
Same output...

$ odbcinst -j
unixODBC 2.3.7
DRIVERS............: /etc/odbcinst.ini
SYSTEM DATA SOURCES: /etc/odbc.ini
FILE DATA SOURCES..: /etc/ODBCDataSources
USER DATA SOURCES..: /home/lcl/.odbc.ini
SQLULEN Size.......: 8
SQLLEN Size........: 8
SQLSETPOSIROW Size.: 8

System files empty, no user ini file.

Looks OK as far as it goes.

Whiteboard: (none) => MGA6-64-OK
CC: (none) => tarazed25

Comment 7 Thomas Andrews 2018-09-21 03:58:30 CEST
In the absence of reported problems, I'm going to validate. Suggested advisory in Comment 4.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Dave Hodgins 2018-09-21 16:37:14 CEST

CC: (none) => davidwhodgins
Keywords: (none) => advisory

Comment 8 Mageia Robot 2018-09-21 18:27:34 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2018-0379.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.