Borland Interbase Server Contains Backdoor Account

Reported January 10, 2001, by CERT

VERSIONS AFFECTED

  • Borland/Inprise Interbase 4.x and 5.x

  • Open source Interbase 6.0 and 6.01

  • Open source Interbase Firebird 0.9 through 3 and earlier

DESCRIPTION

Borland's standard Interbase package and the Firebird Project Interbase package both contain a backdoor account embedded into the code. Since the account is compiled in, a user cannot remove the account from an installed copy of Interbase.

The open source Interbase database system listens on TCP port 3050 where an intruder can connect and manipulate database objects on the server. According to CERT Advisory CA-2001-01, this type of attack includes the ability to insert stored procedures and can lead to further system and network compromise.

VENDOR RESPONSE

Borland and Firebird offer fixes for both versions of the Interbase package.

CREDIT
Discovered by CERT

Hide comments

Comments

  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.
Publish