The OpenNET Project
 
Search (keywords):  SOFT ARTICLES TIPS & TRICKS SECURITY
LINKS NEWS MAN DOCUMENTATION


FreeBSD Ports Security Advisory FreeBSD-SA-01:26.interbase


<< Previous INDEX Search src Set bookmark Go to bookmark Next >>
Date: Mon, 12 Mar 2001 15:34:53 -0800
From: FreeBSD Security Advisories <security-advisories@FreeBSD.org.>
To: [email protected]
Subject: FreeBSD Ports Security Advisory FreeBSD-SA-01:26.interbase

-----BEGIN PGP SIGNED MESSAGE-----


FreeBSD-SA-01:26 Security Advisory FreeBSD, Inc. Topic: interbase contains remote backdoor Category: ports Module: interbase Announced: 2001-03-12 Credits: Firebird project <http://firebird.sourceforge.net>; Affects: Ports collection prior to the correction date. Corrected: See below. Vendor status: No update released FreeBSD only: NO I. Background Interbase is a SQL database server from Borland. II. Problem Description The interbase software contains a remote backdoor account, which was apparently introduced by the vendor in 1992. The interbase source code has recently been released and is the basis for a derivative project called firebird, who are credited with discovering the vulnerability. The backdoor account has full read and write access to databases stored on the server, and also gives the ability to write to arbitrary files on the server as the user running the interbase server (usually user root). Remote attackers may connect to the database on TCP port 3050. The interbase port is not installed by default, nor is it "part of FreeBSD" as such: it is part of the FreeBSD ports collection, which contains nearly 4700 third-party applications in a ready-to-install format. The ports collections shipped with FreeBSD 3.5.1 and 4.2 contain this problem since it was discovered after the releases. FreeBSD makes no claim about the security of these third-party applications, although an effort is underway to provide a security audit of the most security-critical ports. III. Impact Remote users who can connect to the interbase database server can obtain full access to all databases using a backdoor account built into the server itself. This account cannot be disabled. If you have not chosen to install the interbase port/package, then your system is not vulnerable to this problem. IV. Workaround 1) Deinstall the interbase port/package, if you have installed it. 2) Use packet filters on your perimeter firewalls, or ipfw(8)/ipf(8) on the interbase server to prevent connections from untrusted systems to TCP port 3050 on the interbase server. Note that local users, or arbitrary users on systems permitted to connect to the TCP port can still access the backdoor account. 3) Migrate to the firebird database, which is an open-source derivative of the interbase software which does not contain the backdoor account. V. Solution The FreeBSD port of interbase is not provided by Borland -- it is provided in binary form from Rios Corporation -- and there does not appear to be a patch available for the security vulnerability. Therefore there is currently no complete solution to this security vulnerability; see the previous section for possible workarounds. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.4 (FreeBSD) Comment: For info see http://www.gnupg.org iQCVAwUBOq1c21UuHi5z0oilAQEfhgP/aoWhV5eBmmKkYcpVxRhu+FkkOYJvIwih RIsCmTKISP5f0smt37Qw4B0o5F2EmAUVncYFNGK39Co+Pxr9eyRx0PD4HvX8JnZ3 7QtqRE4Oh2LwX0xpd9tpUpT1yxdGX9u+TSB+9MdB5hIyEsnRjwuMwZn1vUOBB8uk whVMpvQLc/w= =C9Nl -----END PGP SIGNATURE-----

<< Previous INDEX Search src Set bookmark Go to bookmark Next >>



Партнёры:
PostgresPro
Inferno Solutions
Hosting by Hoster.ru
Хостинг:

Закладки на сайте
Проследить за страницей
Created 1996-2024 by Maxim Chirkov
Добавить, Поддержать, Вебмастеру