Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email firstname.lastname@example.org
Interbase/Firebird - external file security bug
From: Kotala Zdeněk (Zdenek.KotalaMius.cz)
Date: Sat Apr 05 2003 - 04:24:53 CST
Class: IB/FB can create or modify all accessible files on disk
Vulnerable: IB 6.01, IB6.5, FB 1.0.2 (WIN/Linux)
Not Vulnerable: IB7.0
Not Tested: FB 1.5 Beta
IB/FB support external file for table. Data store in raw format and
there isn't access rectriction. If file exist it's opened for R/W append
Default IB6/FB1 installation use system (win) or root(linux) account to run
This bug is exploitable only if user is authorized into ibserver, but on
linux instalation FB1.0.2, I can create database and external table without
user/password(isql has been used). And in another case, there are many
methods how is possible get password (sniffs, brute force ...).
There tree method for abusing this security bug:
1) First method allows users to carry away binary database file.
This metod was reported on Borland QualityCentral (5.3.2002). It's
2) With this issue IBserver can read and modify all files accesible on
external table is used, only raw data are stored into file. The linux
create table test external '/etc/passwd' (id char(80));
insert into test values('r00t::0:0:root:/root:/bin/bash');
This example append r00t user into system without password and with root
3) Concept of third method is to use UDF function for installation back door
1) cracker create external file into UDF libs dir which contain backdoor
2) import udf function and start them from SQL,
3) install better backdoor thru the UDF backdoor.
I don't test UDF example, but I thing that it's will work. It may be used
under other user account.
Upgrade to IB version 7 or you may convert process owner from root/SYSTEM to
other with more security restriction, but this isn't defence for method 1.
FB 1.0.2 contain script for convert rights from root to firebird account,
it's don't work correctly. All firebird's binary dirs are owned by firebird
and it may be abused for installation bad UDF lib.
Thanks to Craig Stuntz
Firebird and Iterbase team was contacted.