Reported
January 10, 2001,
by CERT
VERSIONS AFFECTED
-
Borland/Inprise Interbase 4.x and 5.x
-
Open source Interbase 6.0 and 6.01
- Open
source Interbase Firebird 0.9 through 3 and earlier
DESCRIPTION
Borland's standard Interbase package and the Firebird
Project Interbase package both contain a backdoor account embedded into the
code. Since the account is compiled in, a user cannot remove the account from an
installed copy of Interbase.
The
open source Interbase database system listens on TCP port 3050 where an intruder
can connect and manipulate database objects on the server. According to CERT
Advisory CA-2001-01,
this type of attack includes the ability to insert stored procedures and can
lead to further system and network compromise.
VENDOR
RESPONSE
Borland
and Firebird
offer fixes for both versions of the Interbase package.
CREDIT
Discovered by CERT