Bug 908127 (CVE-2014-9323) - VUL-0: CVE-2014-9323: firebird server can be forced to segfault by bad packet
Summary: VUL-0: CVE-2014-9323: firebird server can be forced to segfault by bad packet
Status: RESOLVED FIXED
: 910653 (view as bug list)
Alias: CVE-2014-9323
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other openSUSE 13.2
: P2 - High : Major
Target Milestone: ---
Assignee: Michal Kubeček
QA Contact: Security Team bot
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-12-03 07:16 UTC by Michal Kubeček
Modified: 2015-08-20 12:00 UTC (History)
4 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Michal Kubeček 2014-12-03 07:16:03 UTC 
Remote DoS: firebird server segfaults when processing an incorrect packet.

Upstream tracker: http://tracker.firebirdsql.org/browse/CORE-4629

Reproducer is not public yet so I'm not going to attach it here for now. Fix
has been submitted to SVN, I'm going to test it and provide updated packages.

Affected Firebird versions: all 2.1 and 2.5. Affected distributions: all
maintained openSUSE, SLED12, SLE12-WE.
Comment 1 Michal Kubeček 2014-12-03 07:28:07 UTC 
Adding SLE maintainer(s) to Cc.
Comment 2 Michal Kubeček 2014-12-03 08:31:08 UTC 
Hm... looks like only libfbembed is actually in SLED12 and SLE12-WE so there
is probably no need for a SLE12 update.
Comment 3 Frederic Crozat 2014-12-05 10:39:09 UTC 
I've quickly checked and libfbembed is pulled by libreoffice, that's it, so I agree with your analysis, not vulnerable for SLE12.
Comment 4 Bernhard Wiedemann 2014-12-08 09:00:39 UTC 
This is an autogenerated message for OBS integration:
This bug (908127) was mentioned in
https://build.opensuse.org/request/show/264372 Factory / firebird
Comment 5 Swamp Workflow Management 2014-12-11 23:04:59 UTC 
openSUSE-SU-2014:1621-1: An update that contains security fixes can now be installed.

Category: security (important)
Bug References: 908127
CVE References: 
Sources used:
openSUSE Evergreen 11.4 (src):    firebird-2.1.3.18185.0-20.1
Comment 6 Swamp Workflow Management 2014-12-15 12:08:00 UTC 
openSUSE-SU-2014:1642-1: An update that contains security fixes can now be installed.

Category: security (important)
Bug References: 908127
CVE References: 
Sources used:
openSUSE 13.2 (src):    firebird-2.5.2.26539-14.4.1, firebird-classic-2.5.2.26539-14.4.1
openSUSE 13.1 (src):    firebird-2.5.2.26539-8.4.1, firebird-classic-2.5.2.26539-8.4.1
openSUSE 12.3 (src):    firebird-2.5.2.26539-2.9.1, firebird-classic-2.5.2.26539-2.9.1
Comment 7 Michal Kubeček 2014-12-19 10:14:56 UTC 
The fix is now in Factory and all maintained versions of openSUSE. Closing.

(Added CVE reference to Summary.)
Comment 8 Michal Kubeček 2015-01-29 07:10:37 UTC 
*** Bug 910653 has been marked as a duplicate of this bug. ***
Comment 9 Bernhard Wiedemann 2015-08-20 12:00:09 UTC 
This is an autogenerated message for OBS integration:
This bug (908127) was mentioned in
https://build.opensuse.org/request/show/324618 42 / firebird