Firebird database name buffer overflow

firebird-database-name-bo (16229) The risk level is classified as HighHigh Risk

Description:

Firebird is a cross-platform embedded database program, developed by SourceForge. Firebird version 1.0 running on Debian Linux is vulnerable to a buffer overflow, caused by improper handling of database names. A local attacker could exploit this vulnerability to overflow a buffer and execute arbitrary code on the system or cause the server to crash.

Platforms Affected:

  • Debian, Debian Linux 3.1
  • Debian, Debian Linux
  • FirebirdSQL, Firebird 1.0

Remedy:

Upgrade to the latest version of Firebird (1.5.0 or later), available from the Firebird Web page. See References.

For Debian GNU/Linux:
Refer to DSA-1014-1 for patch, upgrade, or suggested workaround information. See References.

Consequences:

Gain Access

References:

  • Firebird Web page, Firebird - Relational Database for the New Millennium at http://firebird.sourceforge.net/.
  • SecuriTeam Mailing List, UNIX focus 23 May 2004, Firebird Database Remote Database Name Overflow at http://www.securiteam.com/unixfocus/5AP0P0UCUO.html.
  • BID-10446: Firebird Remote Pre-Authentication Database Name Buffer Overrun Vulnerability
  • CVE-2004-2043: Buffer overflow in ibserver for Firebird Database 1.0 and other versions before 1.5, and possibly other products that use the InterBase codebase, allows remote attackers to cause a denial of service (crash) via a long database name, as demonstrated using the gsec command.
  • DSA-1014: firebird2 -- buffer overflow
  • OSVDB ID: 6408: Firebird Database Remote Database Name Overflow DoS
  • OSVDB ID: 6624: Borland Interbase Database Name Overflow
  • SA11756: Borland Interbase / Firebird Database Name Buffer Overflow Vulnerability
  • SECTRACK ID: 1010381: InterBase Buffer Overflow in Processing Database Name Lets Remote Users Execute Arbitrary Code

Reported:

May 23, 2004

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.

For corrections or additions please email xforce@iss.net

Return to the main page