Package: firebird2.0-super
Version: 2.0.3.12981.ds1-13
Severity: grave
Tags: security
The only reason for this to not be of critical severity is that database
services are typically firewalled.
This is CVE-2008-1880[1]
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-1880
The init.d script used by Debian packages exports ISC_PASSWORD into the
environment before starting fbguard. fbguard itself spawns fbserver
process without cleaning environment.
fbserver uses ISC_PASSWORD from the environment when remote connection
does not supply a password. This makes it possible to connect remotely
as SYSDBA user without giving a password.
That last part is already fixed in upstream CVS HEAD, but backporting
the change is reported to be non-trivial.
So the way to close the hole is to stop exporting ISC_PASSWORD in the
init.d script. That variable is used only for stopping the server and
there is another way to achieve this -- via start-stop-daemon and a PID
file.
I am working on the implementation.
--
dam
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
