Borland Interbase Server Contains Backdoor Account

Reported January 10, 2001, by CERT


  • Borland/Inprise Interbase 4.x and 5.x

  • Open source Interbase 6.0 and 6.01

  • Open source Interbase Firebird 0.9 through 3 and earlier


Borland's standard Interbase package and the Firebird Project Interbase package both contain a backdoor account embedded into the code. Since the account is compiled in, a user cannot remove the account from an installed copy of Interbase.

The open source Interbase database system listens on TCP port 3050 where an intruder can connect and manipulate database objects on the server. According to CERT Advisory CA-2001-01, this type of attack includes the ability to insert stored procedures and can lead to further system and network compromise.


Borland and Firebird offer fixes for both versions of the Interbase package.

Discovered by CERT

Hide comments


  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.