
FYI,


CERT Advisory CA-2001-01 Interbase Server Contains
Compiled-in Back Door
Account

   Original release date: January 10, 2001
   Last revised: --
   Source: CERT/CC

   A complete revision history is at the end of this file.

Systems Affected

     * Borland/Inprise Interbase 4.x and 5.x
     * Open source Interbase 6.0 and 6.01
     * Open source Firebird 0.9-3 and earlier

Overview

   Interbase is an open source database package that had
previously been
   distributed in a closed source fashion by
Borland/Inprise. Both the
   open and closed source verisions of the Interbase server
contain a
   compiled-in back door account with a known password.

I. Description

   Interbase is an open source database package that is
distributed by
   Borland/Inprise at http://www.borland.com/interbase/ and
on
   SourceForge. The Firebird Project, an alternate Interbase
package, is
   also distributed on SourceForge. The Interbase server for
both
   distributions contains a compiled-in back door account
with a fixed,
   easily located plaintext password. The password and
account are
   contained in source code and binaries previously made
available at the
   following sites:

          http://www.borland.com/interbase/
          http://sourceforge.net/projects/interbase
          http://sourceforge.net/projects/firebird
          http://firebird.sourceforge.net
          http://www.ibphoenix.com
          http://www.interbase2000.com

   This back door allows any local user or remote user able
to access
   port 3050/tcp [gds_db] to manipulate any database object
on the
   system. This includes the ability to install trapdoors or
other trojan
   horse software in the form of stored procedures. In
addition, if the
   database software is running with root privileges, then
any file on
   the server's file system can be overwritten, possibly
leading to
   execution of arbitrary commands as root.

   This vulnerability was not introduced by unauthorized
modifications to
   the original vendor's source. It was introduced by
maintainers of the
   code within Borland. The back door account password
cannot be changed
   using normal operational commands, nor can the account be
deleted from
   existing vulnerable servers [see References].

   This vulnerability has been assigned the identifier
CAN-2001-0008 by
   the Common Vulnerabilities and Exposures (CVE) group:

         
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2001-0008

   The CERT/CC has not received reports of this back door
being exploited
   at the current time. We do recommend, however, that all
affected sites
   and redistributors of Interbase products or services
follow the
   recommendations suggested in Section III, as soon as
possible due to
   the seriousness of this issue.

II. Impact

   Any local user or remote user able to access port
3050/tcp [gds_db]
   can manipulate any database object on the system. This
includes the
   ability to install trapdoors or other trojan horse
software in the
   form of stored procedures. In addition, if the database
software is
   running with root privileges, then any file on the
server's file
   system can be overwritten, possibly leading to execution
of arbitrary
   commands as root.

III. Solution

Apply a vendor-supplied patch

   Both Borland and The Firebird Project on SourceForge have
published
   fixes for this problem. Appendix A contains information
provided by
   vendors supplying these fixes. We will update the
appendix as we
   receive more information. If you do not see your vendor's
name, the
   CERT/CC did not hear from that vendor. Please contact
your vendor
   directly.

   Users who are more comfortable making their own changes
in source code
   may find the new code available on SourceForge useful as
well:

          http://sourceforge.net/projects/interbase
          http://sourceforge.net/projects/firebird

Block access to port 3050/tcp

   This will not, however, prevent local users or users
within a
   firewall's adminstrative boundary from accessing the back
door
   account. In addition, the port the Interbase server
listens on may be
   changed dynamically at startup.

Appendix A. Vendor Information

Borland

   Please see:

          http://www.borland.com/interbase/

IBPhoenix

   The Firebird project uncovered serious security problems
with
   InterBase. The problems are fixed in Firebird build 0.9.4
for all
   platforms. If you are running either InterBase V6 or
Firebird 0.9.3,
   you should upgrade to Firebird 0.9.4.

   These security holes affect all version of InterBase
shipped since
   1994, on all platforms.

   For those who can not upgrade, Jim Starkey developed a
patch program
   that will correct the more serious problems in any
version of
   InterBase on any platform. IBPhoenix chose to release the
program
   without charge, given the nature of the problem and our
relationship
   to the community.

   At the moment, name service is not set up to the machine
that is
   hosting the patch, so you will have to use the IP number
both for the
   initial contact and for the ftp download.

   To start, point your browser at

          http://firebird.ibphoenix.com/

Apple

   The referenced database package is not packaged with Mac
OS X or Mac
   OS X Server.

Fujitsu

   Fujitsu's UXP/V operating system is not affected by this
problem
   because we don't support the relevant database.

References

    1. VU#247371: Borland/Inprise Interbase SQL database
server contains
       backdoor superuser account with known password
CERT/CC,
       01/10/2001, https://www.kb.cert.org/vuls/id/247371
    
_________________________________________________________________

   Author: This document was written by Jeffrey S Havrilla.
Feedback on
   this advisory is appreciated.
  
______________________________________________________________________

   This document is available from:
   http://www.cert.org/advisories/CA-2001-01.html
  
______________________________________________________________________

CERT/CC Contact Information

   Email: cert@cert.org
          Phone: +1 412-268-7090 (24-hour hotline)
          Fax: +1 412-268-6989
          Postal address:
          CERT Coordination Center
          Software Engineering Institute
          Carnegie Mellon University
          Pittsburgh PA 15213-3890
          U.S.A.

   CERT personnel answer the hotline 08:00-20:00 EST(GMT-5)
/ EDT(GMT-4)
   Monday through Friday; they are on call for emergencies
during other
   hours, on U.S. holidays, and on weekends.

Using encryption

   We strongly urge you to encrypt sensitive information
sent by email.
   Our public PGP key is available from

   http://www.cert.org/CERT_PGP.key

   If you prefer to use DES, please call the CERT hotline
for more
   information.

Getting security information

   CERT publications and other security information are
available from
   our web site

   http://www.cert.org/

   To subscribe to the CERT mailing list for advisories and
bulletins,
   send email to majordomo@cert.org. Please include in the
body of your
   message

   subscribe cert-advisory

   * "CERT" and "CERT Coordination Center" are registered in
the U.S.
   Patent and Trademark Office.
  
______________________________________________________________________

   NO WARRANTY
   Any material furnished by Carnegie Mellon University and
the Software
   Engineering Institute is furnished on an "as is" basis.
Carnegie
   Mellon University makes no warranties of any kind, either
expressed or
   implied as to any matter including, but not limited to,
warranty of
   fitness for a particular purpose or merchantability,
exclusivity or
   results obtained from use of the material. Carnegie
Mellon University
   does not make any warranty of any kind with respect to
freedom from
   patent, trademark, or copyright infringement.
    
_________________________________________________________________

   Conditions for use, disclaimers, and sponsorship
information

   Copyright 2001 Carnegie Mellon University.

Wed, 10 Jan 2001 19:11:18 -0500
Mike Mascari <mascarm@mascari.com>
Interesting CERT advisory
> Both the open and closed source versions of the Interbase server
> contain a compiled-in back door account with a known password.

Darn. We are probably too late in beta to consider adding this feature;
we'll have to play catchup in 7.2 ;)

                     - Thomas

Thu, 11 Jan 2001 03:28:22 +0000
Thomas Lockhart <lockhart@alumni.caltech.edu>
Re: Interesting CERT advisory