OpenLink Virtuoso Denial-of-Service Vulnerability in Row Insert Cast Component

A denial-of-service vulnerability has been identified in OpenLink Virtuoso Open Source version 7.2.11. The issue arises in the row_insert_cast component, where attackers can cause a service disruption by using specially crafted SQL statements. This vulnerability can be reproduced using the Virtuoso Docker image.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing the Virtuoso server to crash.

Reproduction

The vulnerability can be reproduced by creating a SQL file with a specific payload that exploits the row_insert_cast component. This payload can be generated using a database management system fuzzer. After removing any existing Docker container named 'virtdb_test', a new container can be started with the Virtuoso image. Once the server is running, the SQL file can be executed using the isql command-line interface, which will trigger the denial-of-service condition by causing the Virtuoso server to crash.

Remediation

Users can update to the latest version of OpenLink Virtuoso to address this vulnerability.