Debian Security Advisory

DSA-1014-1 firebird2 -- buffer overflow

Date Reported:

23 Mar 2006

Affected Packages:

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 357580.
In the Bugtraq database (at SecurityFocus): BugTraq ID 10446.
In Mitre's CVE dictionary: CVE-2004-2043.

More information:

Aviram Jenik and Damyan Ivanov discovered a buffer overflow in firebird2, an RDBMS based on InterBase 6.0 code, that allows remote attackers to crash.

The old stable distribution (woody) does not contain firebird2 packages.

For the stable distribution (sarge) this problem has been fixed in version 1.5.1-4sarge1.

For the unstable distribution (sid) this problem has been fixed in version 1.5.3.4870-3

We recommend that you upgrade your firebird2 packages.

Fixed in:

Debian GNU/Linux 3.1 (sarge)

Source:: http://security.debian.org/pool/updates/main/f/firebird2/firebird2_1.5.1-4sarge1.dsc; http://security.debian.org/pool/updates/main/f/firebird2/firebird2_1.5.1-4sarge1.diff.gz; http://security.debian.org/pool/updates/main/f/firebird2/firebird2_1.5.1.orig.tar.gz
Intel IA-32:: http://security.debian.org/pool/updates/main/f/firebird2/firebird2-classic-server_1.5.1-4sarge1_i386.deb; http://security.debian.org/pool/updates/main/f/firebird2/firebird2-dev_1.5.1-4sarge1_i386.deb; http://security.debian.org/pool/updates/main/f/firebird2/firebird2-examples_1.5.1-4sarge1_i386.deb; http://security.debian.org/pool/updates/main/f/firebird2/firebird2-server-common_1.5.1-4sarge1_i386.deb; http://security.debian.org/pool/updates/main/f/firebird2/firebird2-super-server_1.5.1-4sarge1_i386.deb; http://security.debian.org/pool/updates/main/f/firebird2/firebird2-utils-classic_1.5.1-4sarge1_i386.deb; http://security.debian.org/pool/updates/main/f/firebird2/firebird2-utils-super_1.5.1-4sarge1_i386.deb; http://security.debian.org/pool/updates/main/f/firebird2/libfirebird2-classic_1.5.1-4sarge1_i386.deb; http://security.debian.org/pool/updates/main/f/firebird2/libfirebird2-super_1.5.1-4sarge1_i386.deb

MD5 checksums of the listed files are available in the original advisory.