CVE-2011-0026

Published: Jan 12, 2011Modified: Apr 29, 2026

9.3

Vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 8.6 / Impact: 10.0

Source: NVD

Description

Integer signedness error in the SQLConnectW function in an ODBC API (odbc32.dll) in Microsoft Data Access Components (MDAC) 2.8 SP1 and SP2, and Windows Data Access Components (WDAC) 6.0, allows remote attackers to execute arbitrary code via a long string in the Data Source Name (DSN) and a crafted szDSN argument, which bypasses a signed comparison and leads to a buffer overflow, aka "DSN Overflow Vulnerability."

Affected (3)

Products: Microsoft: Data Access Components, Windows Data Access Components

Microsoft

2 products

Data Access Components

Windows Data Access Components

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Microsoft Data Access Components	Version 2.8 sp1

Running on/with	Platform Versions
Microsoft Windows Xp	All versions

Configuration B

1 vulnerable · 3 platform

Vulnerable Software	Affected Versions
Microsoft Data Access Components	Version 2.8 sp2

Running on/with	Platform Versions
Microsoft Windows 2003 Server	All versions
Microsoft Windows Server 2003	All versions
Microsoft Windows Xp	All versions

Configuration C

1 vulnerable · 11 platform

Vulnerable Software	Affected Versions
Microsoft Windows Data Access Components	Version 6.0

Running on/with	Platform Versions
Microsoft Windows 7	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Server 2008	Version r2
Microsoft Windows Server 2008	Version r2
Microsoft Windows Vista	All versions
Microsoft Windows Vista	All versions