PT-2016-1135 · Firebird · Firebird

Salvatore Bonaccorso · Published 2016-01-13 · Updated 2016-12-06 · CVE-2016-1569

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions FireBird version 2.5.5

Description The issue is caused by insufficient input validation in the database management system, allowing a remote authenticated user to cause a denial of service by crashing the daemon. This can be achieved by using the service manager to invoke the gbak utility with an invalid parameter, such as an incorrect username or password. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Recommendations For FireBird version 2.5.5, as a temporary workaround, consider restricting access to the gbak utility until a patch is available. Avoid using the utility with unvalidated input parameters to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2016-00396

CVE-2016-1569

Affected Products

Firebird

References · 8

• 🔥 http://openwall.com/lists/oss-security/2016/01/10/3 · Exploit
• https://bdu.fstec.ru/vul/2016-00396 · Security Note
• https://osv.dev/vulnerability/CVE-2016-1569 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2016-February/177119.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1569 · Security Note
• http://tracker.firebirdsql.org/browse/CORE-5068 · Note
• http://openwall.com/lists/oss-security/2016/01/10/2 · Note
• http://sourceforge.net/p/firebird/code/62783 · Note