OpenLink Virtuoso Denial-of-Service Vulnerability in SQL Statement Processing

A denial-of-service vulnerability has been identified in OpenLink Virtuoso Open Source version 7.2.11. The issue arises in the 'qi_inst_state_free' component, where attackers can cause a crash by sending specially crafted SQL statements. This vulnerability can be reproduced using the Virtuoso Docker image.

Impact

Exploitation of this vulnerability leads to a crash of the Virtuoso database server, causing a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by first removing any existing Docker container named 'virtdb_test'. Then, start a new Virtuoso container with the DBA password set to 'dba'. After the server has started, verify that the database is responsive by executing a simple query. Once confirmed, the crafted SQL payload that triggers the denial-of-service can be executed, causing the server to crash.

Remediation

Users can upgrade to the patched version of OpenLink Virtuoso to address this vulnerability.