PT-2016-1135 · Firebird · Firebird

Salvatore Bonaccorso · Publicado 2016-01-13 · Atualizado 2016-12-06 · CVE-2016-1569

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions FireBird version 2.5.5

Description The issue is caused by insufficient input validation in the database management system, allowing a remote authenticated user to cause a denial of service by crashing the daemon. This can be achieved by using the service manager to invoke the gbak utility with an invalid parameter, such as an incorrect username or password. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Recommendations For FireBird version 2.5.5, as a temporary workaround, consider restricting access to the gbak utility until a patch is available. Avoid using the utility with unvalidated input parameters to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2016-00396

CVE-2016-1569

Produtos afetados

Firebird

Referências · 8

• 🔥 http://openwall.com/lists/oss-security/2016/01/10/3 · Exploit
• http://tracker.firebirdsql.org/browse/CORE-5068 · Nota
• http://openwall.com/lists/oss-security/2016/01/10/2 · Nota
• https://bdu.fstec.ru/vul/2016-00396 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-1569 · Aviso do Fabricante
• http://sourceforge.net/p/firebird/code/62783 · Nota
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177119.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-1569 · Nota de Segurança