3571e53040
patches for easier mirroring, to eliminate a special copy, to make www.freebsd.org/security a full copy of security.freebsd.org and be eventually be the same. For now files are just sitting there. The symlinks are missing. Discussed on: www (repository location) Discussed with: simon (so)
85 lines
3.3 KiB
Text
85 lines
3.3 KiB
Text
-----BEGIN PGP SIGNED MESSAGE-----
|
|
|
|
=============================================================================
|
|
FreeBSD-SA-01:26 Security Advisory
|
|
FreeBSD, Inc.
|
|
|
|
Topic: interbase contains remote backdoor
|
|
|
|
Category: ports
|
|
Module: interbase
|
|
Announced: 2001-03-12
|
|
Credits: Firebird project <http://firebird.sourceforge.net>
|
|
Affects: Ports collection prior to the correction date.
|
|
Corrected: See below.
|
|
Vendor status: No update released
|
|
FreeBSD only: NO
|
|
|
|
I. Background
|
|
|
|
Interbase is a SQL database server from Borland.
|
|
|
|
II. Problem Description
|
|
|
|
The interbase software contains a remote backdoor account, which was
|
|
apparently introduced by the vendor in 1992. The interbase source
|
|
code has recently been released and is the basis for a derivative
|
|
project called firebird, who are credited with discovering the
|
|
vulnerability.
|
|
|
|
The backdoor account has full read and write access to databases
|
|
stored on the server, and also gives the ability to write to arbitrary
|
|
files on the server as the user running the interbase server (usually
|
|
user root). Remote attackers may connect to the database on TCP port
|
|
3050.
|
|
|
|
The interbase port is not installed by default, nor is it "part of
|
|
FreeBSD" as such: it is part of the FreeBSD ports collection, which
|
|
contains nearly 4700 third-party applications in a ready-to-install
|
|
format. The ports collections shipped with FreeBSD 3.5.1 and 4.2
|
|
contain this problem since it was discovered after the releases.
|
|
|
|
FreeBSD makes no claim about the security of these third-party
|
|
applications, although an effort is underway to provide a security
|
|
audit of the most security-critical ports.
|
|
|
|
III. Impact
|
|
|
|
Remote users who can connect to the interbase database server can
|
|
obtain full access to all databases using a backdoor account built
|
|
into the server itself. This account cannot be disabled.
|
|
|
|
If you have not chosen to install the interbase port/package, then
|
|
your system is not vulnerable to this problem.
|
|
|
|
IV. Workaround
|
|
|
|
1) Deinstall the interbase port/package, if you have installed it.
|
|
|
|
2) Use packet filters on your perimeter firewalls, or ipfw(8)/ipf(8)
|
|
on the interbase server to prevent connections from untrusted systems
|
|
to TCP port 3050 on the interbase server. Note that local users, or
|
|
arbitrary users on systems permitted to connect to the TCP port can
|
|
still access the backdoor account.
|
|
|
|
3) Migrate to the firebird database, which is an open-source
|
|
derivative of the interbase software which does not contain the
|
|
backdoor account.
|
|
|
|
V. Solution
|
|
|
|
The FreeBSD port of interbase is not provided by Borland -- it is
|
|
provided in binary form from Rios Corporation -- and there does not
|
|
appear to be a patch available for the security vulnerability.
|
|
Therefore there is currently no complete solution to this security
|
|
vulnerability; see the previous section for possible workarounds.
|
|
-----BEGIN PGP SIGNATURE-----
|
|
Version: GnuPG v1.0.4 (FreeBSD)
|
|
Comment: For info see http://www.gnupg.org
|
|
|
|
iQCVAwUBOq1c21UuHi5z0oilAQEfhgP/aoWhV5eBmmKkYcpVxRhu+FkkOYJvIwih
|
|
RIsCmTKISP5f0smt37Qw4B0o5F2EmAUVncYFNGK39Co+Pxr9eyRx0PD4HvX8JnZ3
|
|
7QtqRE4Oh2LwX0xpd9tpUpT1yxdGX9u+TSB+9MdB5hIyEsnRjwuMwZn1vUOBB8uk
|
|
whVMpvQLc/w=
|
|
=C9Nl
|
|
-----END PGP SIGNATURE-----
|