PT-2012-1185 · Firebird · Firebird

Jan Lieskovsky · Published 2012-11-19 · Updated 2017-08-29 · CVE-2012-5529

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Firebird versions 2.5.0 through 2.5.1

Description The issue is related to the TraceManager component in the Firebird database management system, which is associated with resource management errors. When trace is enabled, a remote authenticated user can cause a denial of service by preparing an empty dynamic SQL query, leading to a NULL pointer dereference and crash.

Recommendations For Firebird versions 2.5.0 and 2.5.1, consider disabling the trace feature as a temporary workaround to prevent exploitation until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2015-11681

CVE-2012-5529

DSA-2648-1

Affected Products

Firebird

References · 10

• http://tracker.firebirdsql.org/browse/CORE-3884 · Vendor Advisory
• http://debian.org/security/2013/dsa-2648 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-11681 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-5529 · Security Note
• http://securityfocus.com/bid/56521 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/80073 · Note
• http://openwall.com/lists/oss-security/2012/11/14/6 · Note
• http://xforce.iss.net/xforce/xfdb/80073 · Note
• http://securitytracker.com/id?1027769 · Note
• http://openwall.com/lists/oss-security/2012/11/14/8 · Note