A NULL pointer dereference flaw was found in the way Superserver used to handle (accept and reply to) auxiliary connections. A remote attacker could initiate a specially-crafted auxiliary connection request against the Firebird's Superserver, which would lead to denial of service (firebird crash).

References: ----------- http://www.coresecurity.com/content/firebird-sql-dos http://www.securityfocus.com/bid/35842/info

Reproducer: ----------- http://www.securityfocus.com/data/vulnerabilities/exploits/35842.py

Upstream changesets: -------------------- http://tracker.firebirdsql.org/browse/CORE-2563 (search for "Version control")

Patch: ------ http://firebird.cvs.sourceforge.net/viewvc/firebird/firebird2/src/remote/server.cpp?r1=1.158.2.6&r2=1.158.2.7&view=patch

Log: ---- Dmitry Yemanov committed 1 file to 'Firebird' on branch 'B21Release' [20/Jul/09 10:06 AM] Fixed two issues for the case of non-authorized opconnectrequest: 1) Missing error reporting which makes the client to stall forever 2) CORE-2563: Possible DoS attack using the malformed packet sent into the connection port

Credit: ------- Vulnerability discovered and researched by Francisco Falcon from Core Security Technologies.

Integer overflow in Firebird SQL 1.0.3 and earlier, 1.5.x before 1.5.6, 2.0.x before 2.0.4, and 2.1.x before 2.1.0 RC1 might allow remote attackers to execute arbitrary code via crafted (1) opreceive, (2) opstart, (3) opstartandreceive, (4) opsend, (5) opstartandsend, and (6) opstartsendandreceive XDR requests, which triggers memory corruption.