Package: firebird2.5-super,firebird2.5-superclassic Version: 2.5.5.26952.ds4-1 Severity: important Tags: security upstream fixed-upstream Forwarded: http://tracker.firebirdsql.org/browse/CORE-5068
Firebird 2.5.5 can be crashed remotely by authenticated clients by invoking gbak via the service manager using invalid command line switch. Example: $ gbak -b -se service_mgr -user_all_space srv:db.fdb backup.fbk gbak:unknown switch "USER_ALL_SPACE" gbak: ERROR:connection lost to database gbak:Exiting before completion due to errors This is harmless for the -classic flavour where the server process serves only that particular connection, but is at least a DoS for -super and -superclassic where the crashed process serves multiple connections. Upstream SVN already contains the fix¹, which I'll be uploading soon. The issue is introduced in 2.5.5, so previous versions (stable and older) aren't affected. -- dam ¹ https://sourceforge.net/p/firebird/code/62783/ -- System Information: Debian Release: stretch/sid APT prefers unstable APT policy: (500, 'unstable'), (1, 'experimental') Architecture: amd64 (x86_64) Kernel: Linux 4.3.0-1-amd64 (SMP w/4 CPU cores) Locale: LANG=bg_BG.UTF-8, LC_CTYPE=bg_BG.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system)
