Class: IB/FB can create or modify all accessible files on disk
Remote: YES
Localy: YES
Vulnerable: IB 6.01, IB6.5, FB 1.0.2 (WIN/Linux)
Not Vulnerable: IB7.0
Not Tested: FB 1.5 Beta
Overview:
IB/FB support external file for table. Data store in raw format and
there isn't access rectriction. If file exist it's opened for R/W append
mode.
Default IB6/FB1 installation use system (win) or root(linux) account to run
IBServer.
Precondition:
This bug is exploitable only if user is authorized into ibserver, but on
default
linux instalation FB1.0.2, I can create database and external table without
user/password(isql has been used). And in another case, there are many
methods how is possible get password (sniffs, brute force ...).
Description:
There tree method for abusing this security bug:
1) First method allows users to carry away binary database file.
This metod was reported on Borland QualityCentral (5.3.2002). It's
report 278.
2) With this issue IBserver can read and modify all files accesible on
disk. If
external table is used, only raw data are stored into file. The linux
example:
create table test external '/etc/passwd' (id char(80));
insert into test values('r00t::0:0:root:/root:/bin/bash');
This example append r00t user into system without password and with root
access.
3) Concept of third method is to use UDF function for installation back door
into system.
1) cracker create external file into UDF libs dir which contain backdoor
function,
2) import udf function and start them from SQL,
3) install better backdoor thru the UDF backdoor.
I don't test UDF example, but I thing that it's will work. It may be used
under other user account.
Workaround:
Upgrade to IB version 7 or you may convert process owner from root/SYSTEM to
other with more security restriction, but this isn't defence for method 1.
FB 1.0.2 contain script for convert rights from root to firebird account,
but
it's don't work correctly. All firebird's binary dirs are owned by firebird
user
and it may be abused for installation bad UDF lib.
Thanks:
Thanks to Craig Stuntz
Firebird and Iterbase team was contacted.
