PT-2017-3824 · Firebird+2 · Firebird+2

Published 2017-03-24 · Updated 2025-10-10 · CVE-2017-6369

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Firebird versions 2.5.x through 2.5.6 Firebird versions 3.0.x through 3.0.1

Description The issue is related to insufficient checks in the UDF subsystem, allowing remote authenticated users to execute code. This can be achieved by using a 'system' entrypoint from fbudf.so. The vulnerability is associated with errors in executing user-defined functions (UDF) in database management systems.

Recommendations For Firebird versions 2.5.x through 2.5.6, update to version 2.5.7 or later. For Firebird versions 3.0.x through 3.0.1, update to version 3.0.2 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2019-03693

CVE-2017-6369

DLA-879-1

DSA-3824-1

SUSE-SU-2017:1156-1

SUSE-SU-2017_1156-1

USN-3929-1

USN-4822-1

Affected Products

Firebird

Suse

Ubuntu

References · 26

• https://ubuntu.com/security/notices/USN-4822-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-6369 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3824-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3929-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4822-1 · Vendor Advisory
• http://debian.org/security/2017/dsa-3824 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-6369 · Security Note
• https://osv.dev/vulnerability/USN-3929-1 · Vendor Advisory
• http://tracker.firebirdsql.org/browse/CORE-5474 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-03693 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-6369 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-9323 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:1156-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-6369 · Security Note
• https://usn.ubuntu.com/3929-1 · Vendor Advisory