Stack-based buffer overflow in Firebird 2.1.3 through 2.1.5 before 18514, and 2.5.1 through 2.5.3 before 26623, on Windows allows remote attackers to execute arbitrary code via a crafted packet to TCP port 3050, related to a missing size check during extraction of a group number from CNCT information.

The remote host is affected by the vulnerability described in GLSA-201512-11 (Firebird: Buffer Overflow)

    The vulnerability is caused due to an error when processing requests       from remote clients.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, or cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

This update fixes a bug which allows an unauthenticated remote attacker to cause a stack overflow in server code, resulting in either server crash or even code execution as the user running firebird.

Firebird Project reports :

The FirebirdSQL server is vulnerable to a stack-based buffer overflow that can be triggered when an unauthenticated user sends a specially crafted packet. The result can lead to remote code execution as the user which runs the FirebirdSQL server.

fix CVE-2013-2492.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A buffer overflow was discovered in the Firebird database server, which could result in the execution of arbitrary code. In addition, a denial of service vulnerability was discovered in the TraceManager.

A buffer overflow was discovered in the Firebird database server, which could result in the execution of arbitrary code.

ID	Name	Product	Family	Severity
87711	GLSA-201512-11 : Firebird: Buffer Overflow	Nessus	Gentoo Local Security Checks	medium
74929	openSUSE Security Update : firebird (openSUSE-SU-2013:0496-1)	Nessus	SuSE Local Security Checks	medium
65843	FreeBSD : firebird -- Remote Stack Buffer Overflow (6adca5e9-95d2-11e2-8549-68b599b52a02)	Nessus	FreeBSD Local Security Checks	medium
65637	Fedora 17 : firebird-2.5.2.26539.0-2.fc17 (2013-3719)	Nessus	Fedora Local Security Checks	medium
65636	Fedora 18 : firebird-2.5.2.26539.0-2.fc18 (2013-3707)	Nessus	Fedora Local Security Checks	medium
65582	Debian DSA-2648-1 : firebird2.5 - several vulnerabilities	Nessus	Debian Local Security Checks	medium
65581	Debian DSA-2647-1 : firebird2.1 - buffer overflow	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2013-2492

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium