PT-2012-1185 · Firebird · Firebird

Jan Lieskovsky · Publicado 2012-11-19 · Atualizado 2017-08-29 · CVE-2012-5529

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Firebird versions 2.5.0 through 2.5.1

Description The issue is related to the TraceManager component in the Firebird database management system, which is associated with resource management errors. When trace is enabled, a remote authenticated user can cause a denial of service by preparing an empty dynamic SQL query, leading to a NULL pointer dereference and crash.

Recommendations For Firebird versions 2.5.0 and 2.5.1, consider disabling the trace feature as a temporary workaround to prevent exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

BDU:2015-11681

CVE-2012-5529

DSA-2648-1

Produtos afetados

Firebird

Referências · 10

• http://securityfocus.com/bid/56521 · Nota
• http://tracker.firebirdsql.org/browse/CORE-3884 · Aviso do Fabricante
• http://debian.org/security/2013/dsa-2648 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/80073 · Nota
• http://openwall.com/lists/oss-security/2012/11/14/6 · Nota
• https://bdu.fstec.ru/vul/2015-11681 · Nota de Segurança
• http://xforce.iss.net/xforce/xfdb/80073 · Nota
• http://securitytracker.com/id?1027769 · Nota
• http://openwall.com/lists/oss-security/2012/11/14/8 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-5529 · Nota de Segurança