SQL injection in Firebird and Debian Linux - CVE-2017-11509

Vulnerability identifier: #VU37356

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-11509

CWE-ID: CWE-89

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote authenticated user to execute arbitrary code.

An authenticated remote attacker can execute arbitrary code in Firebird SQL Server versions 2.5.7 and 3.0.2 by executing a malformed SQL statement.

Firebird
Debian Linux
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Package Hub 15
openSUSE Leap
firebird-debuginfo
libib_util-32bit-debuginfo
libfbclient2-32bit-debuginfo
libfbclient2-32bit
libib_util-32bit
firebird-doc
libfbclient2-debuginfo
libib_util-devel
firebird-server-debuginfo
firebird-utils
firebird-utils-debuginfo
firebird
libfbclient-devel
libib_util
firebird-server
libib_util-debuginfo
libfbclient2
firebird-examples
firebird-debugsource

Install update from vendor's website.

firebird-debuginfo - update to 3.0.4.33054-150200.3.6.1
libib_util-32bit-debuginfo - update to 3.0.4.33054-150200.3.6.1
libfbclient2-32bit-debuginfo - update to 3.0.4.33054-150200.3.6.1
libfbclient2-32bit - update to 3.0.4.33054-150200.3.6.1
libib_util-32bit - update to 3.0.4.33054-150200.3.6.1
firebird-doc - update to 3.0.4.33054-150200.3.6.1
libfbclient2-debuginfo - update to 3.0.4.33054-150200.3.6.1
libib_util-devel - update to 3.0.4.33054-150200.3.6.1
firebird-server-debuginfo - update to 3.0.4.33054-150200.3.6.1
firebird-utils - update to 3.0.4.33054-150200.3.6.1
firebird-utils-debuginfo - update to 3.0.4.33054-150200.3.6.1
firebird - update to 3.0.4.33054-150200.3.6.1
libfbclient-devel - update to 3.0.4.33054-150200.3.6.1
libib_util - update to 3.0.4.33054-150200.3.6.1
firebird-server - update to 3.0.4.33054-150200.3.6.1
libib_util-debuginfo - update to 3.0.4.33054-150200.3.6.1
libfbclient2 - update to 3.0.4.33054-150200.3.6.1
firebird-examples - update to 3.0.4.33054-150200.3.6.1
firebird-debugsource - update to 3.0.4.33054-150200.3.6.1

• https://lists.debian.org/debian-lts-announce/2018/05/msg00005.html
• https://lists.debian.org/debian-lts-announce/2020/02/msg00036.html
• https://www.tenable.com/security/research/tra-2017-36

• SQL injection in firebird.sourceforge.net Firebird
• SUSE update for firebird