Stack-based buffer overflow in Firebird before 2.0.4, and 2.1.x before 2.1.0 RC1, might allow remote attackers to execute arbitrary code via a long username.
An authenticated remote attacker can execute arbitrary code in Firebird SQL Server versions 2.5.7 and 3.0.2 by executing a malformed SQL statement.
Integer overflow in Firebird SQL 1.0.3 and earlier, 1.5.x before 1.5.6, 2.0.x before 2.0.4, and 2.1.x before 2.1.0 RC1 might allow remote attackers to execute arbitrary code via crafted (1) opreceive, (2) opstart, (3) opstartandreceive, (4) opsend, (5) opstartandsend, and (6) opstartsendandreceive XDR requests, which triggers memory corruption.
FireBird 2.5.5 allows remote authenticated users to cause a denial of service (daemon crash) by using service manager to invoke the gbak utility with an invalid parameter.
A NULL pointer dereference flaw was found in the way Superserver used to handle (accept and reply to) auxiliary connections. A remote attacker could initiate a specially-crafted auxiliary connection request against the Firebird's Superserver, which would lead to denial of service (firebird crash).
References: ----------- http://www.coresecurity.com/content/firebird-sql-dos http://www.securityfocus.com/bid/35842/info
Reproducer: ----------- http://www.securityfocus.com/data/vulnerabilities/exploits/35842.py
Upstream changesets: -------------------- http://tracker.firebirdsql.org/browse/CORE-2563 (search for "Version control")
Patch: ------ http://firebird.cvs.sourceforge.net/viewvc/firebird/firebird2/src/remote/server.cpp?r1=1.158.2.6&r2=1.158.2.7&view=patch
Log: ---- Dmitry Yemanov committed 1 file to 'Firebird' on branch 'B21Release' [20/Jul/09 10:06 AM] Fixed two issues for the case of non-authorized opconnectrequest: 1) Missing error reporting which makes the client to stall forever 2) CORE-2563: Possible DoS attack using the malformed packet sent into the connection port
Credit: ------- Vulnerability discovered and researched by Francisco Falcon from Core Security Technologies.
Last updated 24 July 2024
TraceManager in Firebird 2.5.0 and 2.5.1, when trace is enabled, allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) by preparing an empty dynamic SQL query.