CVE-2024-57640

What it actually does

Crafted SQL statements trigger a denial of service condition inside the dc_add_int component by causing the process to crash or become unresponsive.

Why it matters to the business

Applications and services relying on the affected database engine experience unplanned outages, degraded availability, and potential loss of access for users until the instance is restarted.

How an attack unfolds

An attacker with the ability to submit SQL statements connects to the database and supplies a specially formed query that reaches the vulnerable dc_add_int logic, resulting in a crash without requiring authentication bypass or privilege escalation.

How to fix it

Upgrade all affected Tomcat5 packages on Red Hat JBoss Enterprise Web Server 1 (EL4 and EL5) to the versions listed in the fixed_versions field (for example 5.5.23-1.patch07.19.ep5.el4 and 5.5.23-0jpp.9.6.ep5.el5) and restart the services. If the underlying database engine is also present, apply any corresponding vendor patches for virtuoso-opensource.

How to confirm the fix worked

Confirm the installed package versions match or exceed the fixed releases, review release notes for the dc_add_int fix, and test that previously crashing SQL statements now execute without causing a crash.

Typical attack path

1. Obtain network or local access to a database instance running the vulnerable version
2. Submit a crafted SQL statement targeting the dc_add_int component
3. Observe the server process terminate or enter an unresponsive state
4. Repeat as needed to maintain denial of service

How to detect it

Review database server logs and process crash reports for unexpected terminations immediately after SQL statement execution; correlate with connection records showing untrusted or external clients issuing queries.

What your security team should do

• Apply the listed fixed package versions immediately on all EL4 and EL5 systems
• Restrict direct SQL execution privileges to only trusted accounts until patches are deployed
• Monitor for availability alerts on database instances that expose the vulnerable component