CVE-2008-1880

The CVE-2008-1880 entry concerns Firebird on Gentoo Linux. The default Gentoo init script sets the ISC_PASSWORD environment variable when starting Firebird, which is used for remote SYSDBA connections if no password is supplied. This allows remote attackers to bypass SYSDBA authentication and obt...

CVE-2008-1880

The default configuration of Firebird before 2.0.3.12981.0-r6 on Gentoo Linux sets the ISCPASSWORD environment variable before starting Firebird, which allows remote attackers to bypass SYSDBA authentication and obtain sensitive database information via an empty password...

GLSA-200805-06 : Firebird: Data disclosure

The remote host is affected by the vulnerability described in GLSA-200805-06 Firebird: Data disclosure Viesturs reported that the default configuration for Gentoo's init script '/etc/conf.d/firebird' sets the 'ISCPASSWORD' environment variable when starting Firebird. It will be used when no...

Firebird: Data disclosure

Background Firebird is a multi-platform, open source relational database. Description Viesturs reported that the default configuration for Gentoo's init script "/etc/conf.d/firebird" sets the "ISCPASSWORD" environment variable when starting Firebird. It will be used when no password is supplied b...

Firebird关系数据库'protocol.cpp' XDR协议远程内存破坏漏洞

BUGTRAQ ID: 28403 CVE ID:CVE-2008-0387 CNCVE ID:CNCVE-20080387 Firebird Relational Database是一款关系型数据库。 Firebird Relational Database管理器处理XDR协议上部分标签时存在整数溢出，远程攻击者可以利用漏洞以应用程序进程权限执行任意指令。 当src/remote/protocol.cpp解析器接收到如下非法数据的操作时： opreceive opstart opstartandreceive opsend opstartandsend...

Debian DSA-1529-1 : firebird -- multiple vulnerabilities

Multiple security problems have been discovered in the Firebird database, which may lead to the execution of arbitrary code or denial of service. This Debian security advisory is a bit unusual. While it's normally our strict policy to backport security bugfixes to older releases, this turned out...

[SECURITY] [DSA 1529-1] New Firebird packages fix several vulnerabilities

------------------------------------------------------------------------ Debian Security Advisory DSA-1529-1 [email protected] http://www.debian.org/security/ Moritz Muehlenhoff March 24, 2008 http://www.debian.org/security/faq -...

DSA-1529-1 firebird - multiple vulnerabilities

Multiple security problems have been discovered in the Firebird database, which may lead to the execution of arbitrary code or denial of service. This Debian security advisory is a bit unusual. While it's normally our strict policy to backport security bugfixes to older releases, this turned out ...

firebird-poc.txt

ITDEFENCE.ru Firebird is a relational database offering many ANSI SQL-92 features that runs on Linux, Windows, and a variety of Unix platforms. data-pdatarequest; MAPxdrshort, reinterpretcastdata-pdataincarnation; MAPxdrshort, reinterpretcastdata-pdatatransaction; MAPxdrshort,...

GLSA-200803-02 : Firebird: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200803-02 Firebird: Multiple vulnerabilities Firebird does not properly handle certain types of XDR requests, resulting in an integer overflow CVE-2008-0387. Furthermore, it is vulnerable to a buffer overflow when processing...

Firebird: Multiple vulnerabilities

Background Firebird is a multi-platform, open source relational database. Description Firebird does not properly handle certain types of XDR requests, resulting in an integer overflow CVE-2008-0387. Furthermore, it is vulnerable to a buffer overflow when processing usernames CVE-2008-0467. Impact...

Firebird username buffer overflow

Added: 02/11/2008 CVE: CVE-2008-0467 BID: 27467 OSVDB: 40924 Background Firebird is a freely available relational database which is available for multiple platforms. Problem A buffer overflow vulnerability in Firebird allows remote, unauthenticated attackers to execute arbitrary commands by sendi...

Firebird username buffer overflow

Added: 02/11/2008 CVE: CVE-2008-0467 BID: 27467 OSVDB: 40924 Background Firebird is a freely available relational database which is available for multiple platforms. Problem A buffer overflow vulnerability in Firebird allows remote, unauthenticated attackers to execute arbitrary commands by sendi...

Firebird username buffer overflow

Added: 02/11/2008 CVE: CVE-2008-0467 BID: 27467 OSVDB: 40924 Background Firebird is a freely available relational database which is available for multiple platforms. Problem A buffer overflow vulnerability in Firebird allows remote, unauthenticated attackers to execute arbitrary commands by sendi...

Firebird username buffer overflow

Added: 02/11/2008 CVE: CVE-2008-0467 BID: 27467 OSVDB: 40924 Background Firebird is a freely available relational database which is available for multiple platforms. Problem A buffer overflow vulnerability in Firebird allows remote, unauthenticated attackers to execute arbitrary commands by sendi...

Firebird关系数据库Username参数远程栈溢出漏洞

BUGTRAQ ID: 27467 Firebird是一款提供多个ANSI SQL-92功能的关系型数据库，可运行在Linux、Windows和各种Unix平台下。 Firebird在处理畸形的用户请求时存在漏洞，远程攻击者可能利用此漏洞控制服务器。 如果远程攻击者向Firebird服务器提交了超长用户名的话，就可能触发栈溢出，导致执行任意指令。 Firebird Firebird 2.1 Beta 1 Firebird Firebird 2.1 Alpha 1 Firebird Firebird 2.0.3 Firebird Firebird 2.0.2 Firebird Firebi...

Integer overflow

Integer overflow in Firebird SQL 1.0.3 and earlier, 1.5.x before 1.5.6, 2.0.x before 2.0.4, and 2.1.x before 2.1.0 RC1 might allow remote attackers to execute arbitrary code via crafted 1 opreceive, 2 opstart, 3 opstartandreceive, 4 opsend, 5 opstartandsend, and 6 opstartsendandreceive XDR...

Stack overflow

Stack-based buffer overflow in Firebird before 2.0.4, and 2.1.x before 2.1.0 RC1, might allow remote attackers to execute arbitrary code via a long username...

CVE-2008-0387

Integer overflow in Firebird SQL 1.0.3 and earlier, 1.5.x before 1.5.6, 2.0.x before 2.0.4, and 2.1.x before 2.1.0 RC1 might allow remote attackers to execute arbitrary code via crafted 1 opreceive, 2 opstart, 3 opstartandreceive, 4 opsend, 5 opstartandsend, and 6 opstartsendandreceive XDR...

CVE-2008-0467

Stack-based buffer overflow in Firebird before 2.0.4, and 2.1.x before 2.1.0 RC1, might allow remote attackers to execute arbitrary code via a long username...