OpenLink Virtuoso Denial-of-Service Vulnerability in SQL Statement Processing Component

A denial-of-service vulnerability has been identified in OpenLink Virtuoso Open Source version 7.2.11. The issue arises in the 'dfe_inx_op_col_def_table' component, where attackers can cause a crash by executing specially crafted SQL statements. This vulnerability can be reproduced using the Virtuoso database management system's built-in SQL execution interface.

Impact

Exploitation of this vulnerability leads to a crash of the Virtuoso database server, causing a denial-of-service condition where the server becomes unresponsive or unavailable.

Reproduction

The vulnerability can be reproduced by creating a SQL file with a specific payload that exploits the issue in the 'dfe_inx_op_col_def_table' component. This crafted SQL statement can be executed using the 'isql' command-line interface, which is part of the Virtuoso database management system. The issue can also be reproduced using the OpenLink Virtuoso Docker image.

Remediation

Users can upgrade to the latest version of OpenLink Virtuoso to address this vulnerability.