[ GLSA 200712-06 ] Firebird: Multiple buffer overflows

[GLSA]

Gentoo Linux Security Advisory

Title: Firebird: Multiple buffer overflows (GLSA 200712-06)
Severity: normal
Exploitable: remote
Date: December 09, 2007
Bug(s): #195569
ID: 200712-06

Synopsis


Multiple stack-based buffer overflows were discovered in Firebird.


Background


Firebird is a multi-platfrom, open source relational database.


Affected Packages

Package: dev-db/firebird
Vulnerable: < 2.0.3.12981.0-r2
Unaffected: >= 2.0.3.12981.0-r2
Architectures: All supported architectures


Description


Adriano Lima and Ramon de Carvalho Valle reported that functions
isc_attach_database() and isc_create_database() do not perform proper
boundary checking when processing their input.


Impact


A remote attacker could send specially crafted requests to the Firebird
server on TCP port 3050, possibly resulting in the execution of
arbitrary code with the privileges of the user running Firebird
(usually firebird).


Workaround


There is no known workaround at this time.


Resolution


All Firebird users should upgrade to the latest version: