Secunia

Description
A vulnerability identified in Firebird can reportedly in worst case be exploited by malicious people to compromise a vulnerable system.

The vulnerability is caused by an access control error. The problem is that it is possible to create an external table in an arbitrary file on the system. If the file exists, it is possible to manipulate it by appending data to it. Reportedly, successful exploitation doesn't require that the user has been authenticated.

An example was included in the original advisory, which creates a user with root privileges and no password:

create table test external '/etc/passwd' (id char(80));
insert into test values('r00t::0:0:root:/root:/bin/bash');

The vulnerability has been confirmed in version 1.0.2. It is currently not known whether version 1.5. Beta is vulnerable.

Solution
Allow only trusted users access to the system. Filter traffic to the ports, which Firebird is listening on.

Provided and/or discovered by
Kotala Zdenek

Deep Links
Links available in Customer Area