A NULL pointer dereference flaw was found in the way Superserver used to handle (accept and reply to) auxiliary connections. A remote attacker could initiate a specially-crafted auxiliary connection request against the Firebird's Superserver, which would lead to denial of service (firebird crash).

References: ----------- http://www.coresecurity.com/content/firebird-sql-dos http://www.securityfocus.com/bid/35842/info

Reproducer: ----------- http://www.securityfocus.com/data/vulnerabilities/exploits/35842.py

Upstream changesets: -------------------- http://tracker.firebirdsql.org/browse/CORE-2563 (search for "Version control")

Patch: ------ http://firebird.cvs.sourceforge.net/viewvc/firebird/firebird2/src/remote/server.cpp?r1=1.158.2.6&r2=1.158.2.7&view=patch

Log: ---- Dmitry Yemanov committed 1 file to 'Firebird' on branch 'B21Release' [20/Jul/09 10:06 AM] Fixed two issues for the case of non-authorized opconnectrequest: 1) Missing error reporting which makes the client to stall forever 2) CORE-2563: Possible DoS attack using the malformed packet sent into the connection port

Credit: ------- Vulnerability discovered and researched by Francisco Falcon from Core Security Technologies.

Stack-based buffer overflow in Firebird before 2.0.4, and 2.1.x before 2.1.0 RC1, might allow remote attackers to execute arbitrary code via a long username.