Openlink Virtuoso-Opensource Denial-of-Service Vulnerability in SQL Statement Processing

A denial-of-service vulnerability has been identified in Openlink Virtuoso-Opensource version 7.2.11. The issue arises in the 'qst_vec_set_copy' component, where attackers can cause a crash by executing crafted SQL statements. This vulnerability can be reproduced using the Virtuoso Docker image.

Impact

Exploitation of this vulnerability leads to a crash of the Virtuoso database server, causing a denial-of-service condition.

Reproduction

The vulnerability can be reproduced by running a Docker container with the Openlink Virtuoso-Opensource 7.2.11 image. After starting the container and verifying that the database is accessible, the crafted SQL payload can be executed using the 'isql' command-line interface. The SQL payload, which exploits the vulnerability, can be saved to a file and then executed as a batch command, causing the Virtuoso server to crash.

Remediation

Users can update to the latest version of Openlink Virtuoso-Opensource, where this vulnerability has been fixed.