Firebird INET_connect() and SVC_attach() buffer overflow
| firebird-attach-connect-bo (36957) |  High Risk |
Description:
Firebird is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the INET_connect() and SVC_attach() functions. By sending a specially-crafted request using various parameters, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the database to crash.
Platforms Affected:
- Easy Data Access, Docsvault Profession Edition 2.0
- Easy Data Access, Docsvault Small Business Edition 2.0
- FirebirdSQL, Firebird 1.5.3.4870
- FirebirdSQL, Firebird 1.5.4.4910
Remedy:
Upgrade to the latest version of Firebird (2.0.0.12748 or later), available from the Firebird Web site. See References.
Consequences:
Gain Access
References:
- Docsvault Web site, Docsvault Professional Edition at http://www.docsvault.com/document-management-products.html.
- Docsvault Web site, Docsvault Small Business Edition at http://www.docsvault.com/document-management-products.html.
- Firebird Web site, Firebird at http://www.firebirdsql.org/.
- Full-Disclosure Mailing List, Wed Oct 03 2007 - 21:59:52 CDT, [RISE-2007003] Firebird Relational Database Multiple Buffer Overflow Vulnerabilities at http://archives.neohapsis.com/archives/fulldisclosure/2007-10/0052.html.
- RISE-2007003, Firebird Relational Database Multiple Buffer Overflow Vulnerabilities at http://risesecurity.org/advisory/RISE-2007003/.
- BID-25917: Borland InterBase Multiple Remote Buffer Overflow Vulnerabilities
- BID-25925: Firebird Relational Database Multiple Remote Stack Buffer Overflow Vulnerabilities
- CVE-2007-5245: Multiple stack-based buffer overflows in Firebird LI 1.5.3.4870 and 1.5.4.4910, and WI 1.5.3.4870 and 1.5.4.4910, allow remote attackers to execute arbitrary code via (1) a long service attach request on TCP port 3050 to the SVC_attach function or (2) unspecified vectors involving the INET_connect function.
- FrSIRT/ADV-2007-3380: Firebird 1 Connect and Attach Requests Buffer Overflow Vulnerabilities
- SA27066: Firebird 1 Multiple Buffer Overflow Vulnerabilities
- SA28635: Docsvault Firebird Service Buffer Overflow Vulnerabilities
- SECTRACK ID: 1018773: Firebird Attach, Create, and Service Attach Request Buffer Overflows Let Remote Users Execute Arbitrary Code
Reported:
Oct 03, 2007
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net