CVE-2023-36366
📋 TL;DR
A vulnerability in MonetDB Server's log_create_delta component allows attackers to cause Denial of Service (DoS) by sending crafted SQL statements. This affects MonetDB Server versions 11.45.17 and 11.46.0, potentially disrupting database availability for applications using these versions.
💻 Affected Systems
- MonetDB Server
📦 What is this software?
Monetdb by Monetdb
Monetdb by Monetdb
⚠️ Risk & Real-World Impact
Worst Case
Complete database service disruption, making the database unavailable to all applications and users, potentially causing extended downtime.
Likely Case
Temporary service interruption requiring database restart, causing application errors and brief unavailability.
If Mitigated
Minimal impact with proper network segmentation and monitoring allowing quick detection and response.
🎯 Exploit Status
Exploitation requires sending crafted SQL statements, which is straightforward for attackers with database access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 11.45.17 and 11.46.0
Vendor Advisory: https://github.com/MonetDB/MonetDB/issues/7381
Restart Required: Yes
Instructions:
1. Check current MonetDB version. 2. Upgrade to latest stable version. 3. Restart MonetDB service. 4. Verify the fix.
🔧 Temporary Workarounds
Network Access Restriction
linuxRestrict database access to trusted applications only using firewall rules.
iptables -A INPUT -p tcp --dport 50000 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 50000 -j DROP
🧯 If You Can't Patch
- Implement strict network segmentation to limit database access to essential applications only.
- Deploy WAF or database firewall to filter and monitor SQL queries for suspicious patterns.
🔍 How to Verify
Check if Vulnerable:
Check MonetDB version: mclient -s "SELECT value FROM sys.env() WHERE name = 'monet_version';"Check Version:
mclient -s "SELECT value FROM sys.env() WHERE name = 'monet_version';"Verify Fix Applied:
Verify version is newer than affected versions and test with normal SQL operations.📡 Detection & Monitoring
Log Indicators:
- Database crash logs
- Unexpected service restarts
- Error messages related to log_create_delta
Network Indicators:
- Unusual SQL query patterns from untrusted sources
- Multiple connection attempts with crafted queries
SIEM Query:
source="monetdb.log" AND ("crash" OR "segfault" OR "log_create_delta")