// back

Firebird Weak Password Encryption Vulnerability

07.30.03

BACKGROUND

The Firebird Project's Firebird 1.0.3 is a relational database offering many ANSI SQL-92 features that runs on Linux, Windows, and a variety of Unix platforms. The Firebird database engine is derived from the InterBase product currently owned by Borland.

DESCRIPTION

The default rpm installation of Firebird for Unix operating systems sets the password file as world readable and writable, which allows a local user to take control of the database, and gain root access. It is possible to do this because of Firebird's use of weak encryption methods for encrypting passwords. It is easy to calculate the encryption of a known password, and then edit the password file so that the root user's password is changed to a password of the attacker's choosing. In addition, the double crypt() that Firebird applies does not properly implement the salt and therefore adds no extra security.

ANALYSIS

Improperly configured permissions can often lead too security leaks that go unnoticed by administrators. It is important to check the file permissions on all files that should have restricted access, not just the one mentioned in this report.

DETECTION

Version 1.0.3 of Firebird is known to be vulnerable, and it is likely that earlier versions are vulnerable as well.

WORKAROUND

This problem is simply solved by navigating to the directory that Firebird is installed in, locating the password file (isc4.gdb) and issuing the following command: chmod 600 isc4.gdb. This changes the permissions so that only root can read and write to the password file.

CVE INFORMATION

A Mitre Corp. Common Vulnerabilities and Exposures (CVE) number has not been assigned to this issue.

DISCLOSURE TIMELINE

07/10/2003   Exploit acquired by iDEFENSE
07/11/2003   Initial vendor notification
07/16/2003   iDEFENSE Clients notified
07/30/2003   Public Disclosure

CREDIT

The discoverer of this vulnerability wishes to remain anonymous.

Get paid for vulnerability research
http://www.idefense.com/poi/teams/vcp.jsp

LEGAL NOTICES

Copyright © 2004 Verisign, Inc.

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDEFENSE. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.