Buffer Overflow in Firebird
Gentoo Linux Security Advisory
||GLSA 200405-18 / firebird
||May 23, 2004
||May 22, 2006: 02
All supported architectures
A buffer overflow via environmental variables in Firebird may allow a local
user to manipulate or destroy local databases and trojan the Firebird
Firebird is an open source relational database that runs on Linux,
Windows, and various UNIX systems.
A buffer overflow exists in three Firebird binaries (gds_inet_server,
gds_lock_mgr, and gds_drop) that is exploitable by setting a large
value to the INTERBASE environment variable.
An attacker could control program execution, allowing privilege
escalation to the UID of Firebird, full access to Firebird databases,
and trojaning the Firebird binaries. An attacker could use this to
compromise other user or root accounts.
There is no known workaround.
All users should upgrade to the latest version of Firebird:
Code Listing 3.1: Resolution
# emerge sync
# emerge -pv ">=dev-db/firebird-1.5"
# emerge ">=dev-db/firebird-1.5"