PT-2007-6326 · Borland · Borland Interbase

Published 2007-10-06 · Updated 2017-07-29 · CVE-2007-5243

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Borland InterBase LI versions 8.0.0.53 through 8.1.0.253 Borland InterBase WI versions 5.1.1.680 through 8.1.0.257

Description: The issue allows remote attackers to execute arbitrary code via multiple stack-based buffer overflows. This can be achieved through various means, including a long service attach request on TCP port 3050 to the SVC attach or INET connect function, a long create request on TCP port 3050 to the isc create database or jrd8 create database function, or a long attach request on TCP port 3050 to the isc attach database or PWD db aliased function. Additionally, there are unspecified vectors involving the jrd8 attach database or expand filename2 function.

Recommendations: For Borland InterBase LI versions 8.0.0.53 through 8.1.0.253, consider disabling the SVC attach, INET connect, isc create database, jrd8 create database, isc attach database, and PWD db aliased functions until a patch is available. For Borland InterBase WI versions 5.1.1.680 through 8.1.0.257, consider disabling the SVC attach, INET connect, isc create database, jrd8 create database, isc attach database, and PWD db aliased functions until a patch is available. As a temporary workaround, restrict access to TCP port 3050 to minimize the risk of exploitation.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2007-5243

Affected Products

Borland Interbase

References · 40

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/misc/fb_svc_attach.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/misc/ib_isc_attach_database.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/misc/fb_isc_attach_database.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/ib_inet_connect.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/misc/ib_svc_attach.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/ib_pwd_db_aliased.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/misc/fb_isc_create_database.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/misc/ib_jrd8_create_database.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/misc/ib_isc_create_database.rb · Exploit
• 🔥 https://exploit-db.com/exploits/16447 · Exploit
• 🔥 https://exploit-db.com/exploits/16420 · Exploit
• 🔥 http://risesecurity.org/exploit/9 · Exploit
• 🔥 http://risesecurity.org/exploit/14 · Exploit
• 🔥 http://securityfocus.com/bid/25917 · Exploit
• 🔥 http://risesecurity.org/exploit/15 · Exploit