Buffer overflow in fbserver.exe in Firebird SQL 2 before 2.0.1 allows remote attackers to execute arbitrary code via a large p_cnct_count value in a p_cnct structure in a connect (0x01) request to port 3050/tcp, related to "an InterBase version of gds32.dll."

Multiple security problems have been discovered in the Firebird database, which may lead to the execution of arbitrary code or denial of service. 

This Debian security advisory is a bit unusual.  While it\'s normally our strict policy to backport security bugfixes to older releases, this turned out to be infeasible for Firebird 1.5 due to large infrastructural changes necessary to fix these issues.  As a consequence security support for Firebird 1.5 is hereby discontinued.

The remote host is affected by the vulnerability described in GLSA-200707-01 (Firebird: Buffer overflow)

    Cody Pierce from TippingPoint DVLabs has discovered a buffer overflow     when processing 'connect' requests with an overly large 'p_cnct_count'     value.
  Impact :

    An unauthenticated remote attacker could send a specially crafted     request to a vulnerable server, possibly resulting in the execution of     arbitrary code with the privileges of the user running Firebird.
  Workaround :

    There is no known workaround at this time.

The version of Firebird installed on the remote host is vulnerable to a buffer overflow in its protocol handling routine.  By sending a specially crafted 'op_connect' request, a remote, unauthenticated attacker can execute code on the affected host with SYSTEM privileges.

ID	Name	Product	Family	Severity
38955	Debian DSA-1529-1 : firebird -- multiple vulnerabilities	Nessus	Debian Local Security Checks	critical
25641	GLSA-200707-01 : Firebird: Buffer overflow	Nessus	Gentoo Local Security Checks	critical
25492	Firebird DataBase Server fbserver.exe p_cnct_count Value Remote Overflow	Nessus	Databases	critical

Detections

Analytics

CVE-2007-3181

critical

Tenable Plugins

critical

critical

critical