PT-2014-1959 · Firebird+2 · Firebird+2

Dmitry Kovalenko · Published 2014-12-16 · Updated 2021-03-05 · CVE-2014-9323

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Firebird versions 2.1.x through 2.1.6 Firebird versions 2.5.x through 2.5.2

Description The issue is related to the xdr status vector function and is caused by pointer dereference errors. It allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference, segmentation fault, and crash, via an op response action with a non-empty status.

Recommendations For Firebird versions 2.1.x through 2.1.6, update to version 2.1.7 or later. For Firebird versions 2.5.x through 2.5.2, update to version 2.5.3 SU1 or later. As a temporary workaround, consider restricting access to the xdr status vector function until a patch is available.

Exploit

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2017-2493

BDU:2015-11679

CVE-2014-9323

DLA-123-1

DLA-130-1

DSA-3109-1

USN-3929-1

Affected Products

Alt Linux

Firebird

Ubuntu

References · 21

• 🔥 http://tracker.firebirdsql.org/browse/CORE-4630 · Exploit
• http://lists.opensuse.org/opensuse-security-announce/2014-12/msg00012.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-9323 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-9323 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-9323 · Vendor Advisory
• https://usn.ubuntu.com/3929-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3929-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-03693 · Security Note
• http://debian.org/security/2014/dsa-3109 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6369 · Security Note
• http://firebirdsql.org/en/news/security-updates-for-v2-1-and-v2-5-series-66011 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3929-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-6369 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2017-2493 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2015:172 · Vendor Advisory