CVE-2011-0026

CWE-1893 documents3 sources
Severity
9.3CRITICAL
EPSS
64.3%
top 1.55%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Microsoft Data Access ComponentsMicrosoft Windows Data Access Components
Timeline
PublishedJan 12
Latest updateMay 3

Description

Integer signedness error in the SQLConnectW function in an ODBC API (odbc32.dll) in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2, and Windows Data Access Components (WDAC) 6.0, allows remote attackers to execute arbitrary code via a long string in the Data Source Name (DSN) and a crafted szDSN argument, which bypasses a signed comparison and leads to a buffer overflow, aka "DSN Overflow Vulnerability."

CVSS vector

AV:N/AC:M/C:C/I:C/A:CExploitability: 8.6 | Impact: 10.0

Affected Packages2 packages

🔴Vulnerability Details

2
GHSA
GHSA-g3pv-wmg4-q78r: Integer signedness error in the SQLConnectW function in an ODBC API (odbc32↗2022-05-03
▶
CVEList
CVE-2011-0026: Integer signedness error in the SQLConnectW function in an ODBC API (odbc32↗2011-01-12
▶
CVE-2011-0026 (CRITICAL CVSS 9.3) | Integer signedness error in the SQL | cvebase.io