CVE-2017-6369

NameCVE-2017-6369
DescriptionInsufficient checks in the UDF subsystem in Firebird 2.5.x before 2.5.7 and 3.0.x before 3.0.2 allow remote authenticated users to execute code by using a 'system' entrypoint from fbudf.so.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-879-1, DSA-3824-1
NVD severitymedium (attack range: remote)
Debian Bugs858641, 858644

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
firebird2.5 (PTS)wheezy2.5.2.26540.ds4-1~deb7u2vulnerable
wheezy (security)2.5.2.26540.ds4-1~deb7u3fixed
jessie (security), jessie2.5.3.26778.ds4-5+deb8u1fixed
firebird3.0 (PTS)stretch3.0.1.32609.ds4-14fixed
buster, sid3.0.2.32703.ds4-11fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
firebird2.5source(unstable)(unfixed)medium858641
firebird2.5sourcejessie2.5.3.26778.ds4-5+deb8u1mediumDSA-3824-1
firebird2.5sourcewheezy2.5.2.26540.ds4-1~deb7u3mediumDLA-879-1
firebird3.0source(unstable)3.0.1.32609.ds4-14medium858644

Notes

http://tracker.firebirdsql.org/browse/CORE-5474
Fixed by: https://github.com/FirebirdSQL/firebird/commit/8b2a9cb44bf6055e15f016d70a6842b8ada60375 (3.0)
https://github.com/FirebirdSQL/firebird/commit/9d9b9e0c94e201da489d1da81f858c570d3ca6ef (2.5)
https://github.com/FirebirdSQL/firebird/commit/a802126cd501f641f00d6cda12d5d9ee3ecda6f5 (2.5)

Search for package or bug name: Reporting problems