Bug 919549 - (CVE-2013-2492) CVE-2013-2492 Firebird: CNCT info remote stack buffer overflow
CVE-2013-2492 Firebird: CNCT info remote stack buffer overflow
Status: CLOSED CURRENTRELEASE
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
urgent Severity urgent
: ---
: ---
Assigned To: Red Hat Product Security
impact=critical,public=20130305,repor...
: Security
Depends On: 919551 919552
Blocks:
  Show dependency treegraph
 
Reported: 2013-03-08 14:02 EST by Kurt Seifried
Modified: 2013-04-01 12:18 EDT (History)
4 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-04-01 12:18:13 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Kurt Seifried 2013-03-08 14:02:55 EST
Spencer McIntyre reports:

The FirebirdSQL server is vulnerable to a stack buffer overflow that can be
triggered when an unauthenticated user sends a specially crafted packet. The
result can lead to remote code execution as the user which runs the FirebirdSQL
server. 

Alexander Peshkov adds:

A reason is a bug when extracting a group number from the CNCT info, sent by 
client. Size of received data was not checked. Bug exists from the first most 
days of firebird.

The main irony here is that this group info was never used later in the code, 
and therefore was cleaned up in the trunk. I.e. trunk does not require fixing. 

This is fixed in snapshot builds, build numbers are 26623 for v2.5 and 18514 
for v2.1. Fix available in upstream SVN repository for B2_5_Release branch
(revision 57728).

external references:
http://tracker.firebirdsql.org/browse/CORE-4058
Comment 1 Kurt Seifried 2013-03-08 14:05:48 EST
Created firebird tracking bugs for this issue

Affects: epel-all [bug 919551]
Comment 4 Ramon de C Valle 2013-03-15 13:53:36 EDT
Index: src/remote/inet.cpp
===================================================================
--- src/remote/inet.cpp	(revision 57727)
+++ src/remote/inet.cpp	(revision 57728)
@@ -1252,7 +1252,7 @@
 		case CNCT_group:
 			{
 				const size_t length = id.getClumpLength();
-				if (length != 0)
+				if (length <= sizeof(eff_gid) && length > 0)
 				{
 					eff_gid = 0;
 					memcpy(&eff_gid, id.getBytes(), length);
Comment 5 Fedora Update System 2013-03-20 17:36:28 EDT
firebird-2.5.2.26539.0-2.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Fedora Update System 2013-03-20 17:43:27 EDT
firebird-2.5.2.26539.0-2.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 7 Fedora Update System 2013-03-26 12:41:55 EDT
firebird-2.5.2.26539.0-3.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 8 Fedora Update System 2013-03-26 12:46:06 EDT
firebird-2.1.5.18496.0-4.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.