PT-2013-1302 · Firebird+1 · Firebird+1
Spencer Mcintyre
+1
·
Publicado
2013-03-15
·
Atualizado
2016-12-07
·
CVE-2013-2492
CVSS v2.0
6.8
Média
| Vetor | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Firebird versions 2.1.3 through 2.1.5
Firebird versions 2.5.1 through 2.5.3
Description
The issue is caused by a stack-based buffer overflow in the Firebird database management system. This can be exploited by a remote attacker who sends a specially crafted TCP packet to port 3050, potentially allowing the execution of arbitrary code. The vulnerability is related to a missing size check during the extraction of a group number from CNCT information.
Recommendations
For Firebird versions 2.1.3 through 2.1.5, update to a version after 18514 to resolve the issue.
For Firebird versions 2.5.1 through 2.5.3, update to a version after 26623 to resolve the issue.
As a temporary workaround, consider restricting access to TCP port 3050 to minimize the risk of exploitation.
Exploit
Correção
RCE
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Firebird
Suse