CVE-2009-2620: Input Validation
A NULL pointer dereference flaw was found in the way Superserver used to handle (accept and reply to) auxiliary connections. A remote attacker could initiate a specially-crafted auxiliary connection request against the Firebird's Superserver, which would lead to denial of service (firebird crash).
References: ----------- http://www.coresecurity.com/content/firebird-sql-dos http://www.securityfocus.com/bid/35842/info
Reproducer: ----------- http://www.securityfocus.com/data/vulnerabilities/exploits/35842.py
Upstream changesets: -------------------- http://tracker.firebirdsql.org/browse/CORE-2563 (search for "Version control")
Patch: ------ http://firebird.cvs.sourceforge.net/viewvc/firebird/firebird2/src/remote/server.cpp?r1=1.158.2.6&r2=1.158.2.7&view=patch
Log: ---- Dmitry Yemanov committed 1 file to 'Firebird' on branch 'B21Release' [20/Jul/09 10:06 AM] Fixed two issues for the case of non-authorized opconnectrequest: 1) Missing error reporting which makes the client to stall forever 2) CORE-2563: Possible DoS attack using the malformed packet sent into the connection port
Credit: ------- Vulnerability discovered and researched by Francisco Falcon from Core Security Technologies.
Other sources
src/remote/server.cpp in fbserver.exe in Firebird SQL 1.5 before 1.5.6, 2.0 before 2.0.6, 2.1 before 2.1.3, and 2.5 before 2.5 Beta 2 allows remote attackers to cause a denial of service (daemon crash) via a malformed opconnectrequest message that triggers an infinite loop or NULL pointer dereference.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-2620?
CVE-2009-2620 is classified as a denial of service vulnerability that may cause a crash of the Firebird SQL daemon.
How do I fix CVE-2009-2620?
To address CVE-2009-2620, upgrade to Firebird SQL version 1.5.6, 2.0.6, 2.1.3 or later.
What software versions are affected by CVE-2009-2620?
Firebird SQL versions 1.5, 2.0 up to 2.0.5, 2.1 up to 2.1.2, and 2.5 prior to Beta 2 are affected by CVE-2009-2620.
Can CVE-2009-2620 be exploited remotely?
Yes, CVE-2009-2620 can be exploited remotely via a malformed op_connect_request message.
What impact does CVE-2009-2620 have on systems?
CVE-2009-2620 allows attackers to cause a denial of service through daemon crashes.