OpenLink Virtuoso SQL Injection Vulnerability Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in OpenLink Virtuoso Open Source version 7.2.11. The issue arises in the 'sqlo_expand_jts' component, where attackers can cause a crash by sending specially crafted SQL statements. This vulnerability can be reproduced using the Virtuoso Docker image.

Impact

Exploitation of this vulnerability causes a denial-of-service condition by crashing the Virtuoso database server.

Reproduction

The vulnerability can be reproduced by first creating a SQL file with the crafted SQL injection payload. After removing any existing Docker container named 'virtdb_test', a new container can be started with the Virtuoso Docker image, using the 'dba' password. Once the server is running, the SQL file can be executed using the 'isql' command-line interface, which will trigger the denial-of-service condition by crashing the server.

Remediation

Users can upgrade to the latest version of OpenLink Virtuoso to address this vulnerability.