Embarcadero InterBase XE 'connect' Request Stack Buffer Overflow Vulnerability

Bugtraq ID:	47644
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Apr 29 2011 12:00AM
Updated:	Mar 19 2015 09:13AM
Credit:	Anonymous
Vulnerable:	Embarcadero Technologies InterBase XE 0 Embarcadero Technologies InterBase SMP 2009 9.0.3.437 Embarcadero Technologies InterBase SMP 2009 9.0.2.369
Not Vulnerable:	Embarcadero Technologies InterBase XE Update 2 10.0.2.467 Embarcadero Technologies InterBase XE 64-bit Update 2 10.0.2.474 Embarcadero Technologies InterBase XE 32-bit Update 2 10.0.2.474

Embarcadero InterBase XE 'connect' Request Stack Buffer Overflow Vulnerability

Embarcadero InterBase XE is prone to a stack-based buffer-overflow vulnerability.

Successful exploits will allow attackers to execute arbitrary code with SYSTEM privileges. Failed exploit attempts will result in a denial-of-service condition. A successful attack will completely compromise affected computers.

Embarcadero InterBase XE 'connect' Request Stack Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Embarcadero InterBase XE 'connect' Request Stack Buffer Overflow Vulnerability

Solution:
Updates are available; please see the references for more information.

Embarcadero InterBase XE 'connect' Request Stack Buffer Overflow Vulnerability

References:

• InterBase XE Homepage (Embarcadero)
  
• ZDI-11-153: Embarcadero Interbase connect Request Parsing Remote Code Execution (ZDI Disclosures )
  
• ZDI-11-153 Embarcadero Interbase connect Request Parsing Remote Code Execution V (Zero Day Initiative)