Firebird Remote Pre-Authentication Database Name Buffer Overrun Vulnerability

Bugtraq ID:	10446
Class:	Boundary Condition Error
CVE:	CVE-2004-2043
Remote:	Yes
Local:	No
Published:	Jun 01 2004 12:00AM
Updated:	Dec 12 2006 10:48PM
Credit:	Discovery of this vulnerability is credited to Aviram Jenik <[email protected]>.
Vulnerable:	Firebird Firebird 1.0 Debian Linux 3.1 sparc Debian Linux 3.1 s/390 Debian Linux 3.1 ppc Debian Linux 3.1 mipsel Debian Linux 3.1 mips Debian Linux 3.1 m68k Debian Linux 3.1 ia-64 Debian Linux 3.1 ia-32 Debian Linux 3.1 hppa Debian Linux 3.1 arm Debian Linux 3.1 amd64 Debian Linux 3.1 alpha Debian Linux 3.1 Borland/Inprise InterBase SuperServer 6.0 Borland/Inprise Interbase 7.1 Borland/Inprise Interbase 7.0 Borland/Inprise Interbase 6.5 Borland/Inprise Interbase 6.4 Borland/Inprise Interbase 6.0 - Cobalt Qube 3.0 - Cobalt RaQ 4.0 - Cobalt RaQ 3.0 - Debian Linux 2.2 sparc - Debian Linux 2.2 powerpc - Debian Linux 2.2 IA-32 - Debian Linux 2.2 arm - Debian Linux 2.2 alpha - Debian Linux 2.2 68k - HP HP-UX 11.0 - Mandriva Linux Mandrake 8.2 - Mandriva Linux Mandrake 8.1 ia64 - Mandriva Linux Mandrake 8.1 - Mandriva Linux Mandrake 8.0 ppc - Mandriva Linux Mandrake 8.0 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 - Redhat Linux 7.3 i386 - Redhat Linux 7.2 ia64 - Redhat Linux 7.2 i386 - Redhat Linux 7.1 ia64 - Redhat Linux 7.1 i386 - Redhat Linux 7.1 alpha - Redhat Linux 7.0 sparc - Redhat Linux 7.0 i386 - Redhat Linux 7.0 alpha - Redhat Linux 6.2 sparc - Redhat Linux 6.2 i386 - Redhat Linux 6.2 alpha - SCO Unixware 7.1 - Sun Solaris 8_sparc - SuSE Linux 8.0 i386 - SuSE Linux 7.3 sparc - SuSE Linux 7.3 ppc - SuSE Linux 7.3 i386 - SuSE Linux 7.2 i386 - SuSE Linux 7.1 x86 - SuSE Linux 7.1 sparc - SuSE Linux 7.1 ppc - SuSE Linux 7.1 alpha - SuSE Linux 7.0 sparc - SuSE Linux 7.0 ppc - SuSE Linux 7.0 i386 - SuSE Linux 7.0 alpha - SuSE Linux 6.4 ppc - SuSE Linux 6.4 i386 - SuSE Linux 6.4 alpha Borland/Inprise Interbase 5.0 - HP HP-UX 11.0 - Linux kernel 2.3 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 - SCO Unixware 7.1 - Sun Solaris 8_sparc Borland/Inprise Interbase 4.0 - HP HP-UX 11.0 - Linux kernel 2.3 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 - SCO Unixware 7.1 - Sun Solaris 8_sparc
Not Vulnerable:	Firebird Firebird 1.5

Firebird Remote Pre-Authentication Database Name Buffer Overrun Vulnerability

Firebird is reported prone to a remote buffer-overrun vulnerability. The issue occurs because the application fails to perform sufficient boundary checks when the database server is handling database names.

A remote attacker may exploit this vulnerability, without requiring valid authentication credentials, to influence the execution flow of the affected Firebird database server. Ultimately, this may lead to the execution of attacker-supplied code in the context of the affected software.

Firebird Remote Pre-Authentication Database Name Buffer Overrun Vulnerability

The following example is available:
gsec -database 192.168.1.52:`perl -e'print ("A"x300)'` -user whenever -password whatever

An exploit (priv8ibserverb.pl) that can target Borland Interbase 7.1 SP 2 and lower has been made available by Priv8security.

• /data/vulnerabilities/exploits/priv8ibserverb.pl

Firebird Remote Pre-Authentication Database Name Buffer Overrun Vulnerability

Solution:

The vendor has released an upgrade. Reportedly, this upgrade is not prone to this vulnerability.

Please see the references for more information and fixes.


Firebird Firebird 1.0

• Firebird Firebird V1.5 Downloads
  http://firebird.sourceforge.net/index.php?op=files&id=engine

Firebird Remote Pre-Authentication Database Name Buffer Overrun Vulnerability

References:

• Firebird Homepage (Firebird)