bezpecnostni riziko FB

[respektive]

Ahoj pouzivame Firebird jako uloziste pro nasi aplikaci

Ted jedname s jednim zakaznikem a ten po nas chce zmenu db, protoze pry FB ma nejakou bezpecnostni chybu pres kterou lze kompromitovat server.

Nikdy jsem o tomto neslysel - a oni taky nic nereknou konkretniho - jen ze jej nechteji.

Netusite nekdo co by to mohlo byt? Jestli je to skutecne nejaky problem, nebo jen fake.

Tusim ze by treba slo pres externi tabulky neco zapsat primo na disk - ale tyto mame zakazane.

Moc dekuju za odpoved.

Tom

[Jiří Činčura]

> Ted jedname s jednim zakaznikem a ten po nas chce zmenu db, protoze pry
> FB ma nejakou bezpecnostni chybu pres kterou lze kompromitovat server.

Tak at rekne jakou... Tohle je "jedna pani povidala". Pripadne at udelaji pen-test a je to bez kecu.

> Tusim ze by treba slo pres externi tabulky neco zapsat primo na disk -
> ale tyto mame zakazane.

Jeste zakazat nebo omezit UDF.

--
Mgr. Jiří Činčura
https://www.tabsoverspaces.com/

[respektive]

Odkazali nas na stranku s bezpecnostnimi dirami

CVE-2020-1192: This vulnerability affected Firebird versions 3.0.5 and earlier. It allowed an attacker to execute arbitrary code on the system running the Firebird server by sending a specially crafted SQL statement.
CVE-2021-29557: This vulnerability affected Firebird versions 3.0.6 and earlier. It allowed an attacker to execute arbitrary code on the system running the Firebird server by sending a specially crafted network packet.
CVE-2022-23792: This vulnerability affected Firebird versions 4.0.0 and earlier. It allowed an attacker to execute arbitrary code on the system running the Firebird server by sending a specially crafted SQL…

Here are some of the security vulnerabilities fixed in Firebird 2.5.9:

CVE-2019-12780: This vulnerability allowed an authenticated user to execute arbitrary code on the system running the Firebird server.
CVE-2019-12781: This vulnerability allowed an authenticated user to bypass authentication and connect to the database without providing a username or password.
CVE-2019-12782: This vulnerability allowed an attacker to read the contents of arbitrary files on the system running the Firebird serve

Tom

Dne středa 30. srpna 2023 v 11:37:22 UTC+2 uživatel ji...@cincura.net napsal:

[Jiří Činčura]

> CVE-2020-1192: This vulnerability affected Firebird versions 3.0.5 and
> earlier. It allowed an attacker to execute arbitrary code on the system
> running the Firebird server by sending a specially crafted SQL
> statement.

https://www.cve.org/CVERecord?id=CVE-2020-1192 rika:
A remote code execution vulnerability exists in Visual Studio Code when the Python extension loads workspace settings from a notebook file, aka 'Visual Studio Code Python Extension Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1171.

> CVE-2021-29557: This vulnerability affected Firebird versions 3.0.6 and
> earlier. It allowed an attacker to execute arbitrary code on the system
> running the Firebird server by sending a specially crafted network
> packet.

https://www.cve.org/CVERecord?id=CVE-2021-29557 rika:
TensorFlow is an end-to-end open source platform for machine learning. An attacker can cause a denial of service via a FPE runtime error in `tf.raw_ops.SparseMatMul`. The division by 0 occurs deep in Eigen code because the `b` tensor is empty. The fix will be included in TensorFlow 2.5.0. We will also cherrypick this commit on TensorFlow 2.4.2, TensorFlow 2.3.3, TensorFlow 2.2.3 and TensorFlow 2.1.4, as these are also affected and still in supported range.

Ono odkazovat se jen na CVE, bez dalsiho kontextu je na nic. Zalezi treba i jaky je attack vector apod.

[Robert Kindl]

To je docela slusny blabol, schvalne jsem si ty CVE vyhledal a ani jedno z nich se Firebirdu netyka (jde o chyby ve VisualStudio, TensorFlow, Django, ...).

 

Jinak pokud otazkou je jak presvedcit nekoho, ze nejaky system neni zranitelny a ze v nem neni zneuzitelna chyba, tak odpovedi je – to nelze.

V kazdem produktu je chyba a ne jedna. Od Microsoft SQL pres Oracle az po obycejnou Windows kalkulacku.

A hlavne je tam X jeste neobjevenych chyb.

No a v neposledni rade, spousta tech zranitelnosti je totalne teoretickych vyzadujicich uplneho idiota u klavesnice – protoze nejvetsi zranitelnost jsou uzivatele.

 

To samozrejme nikdo nechce slyset, ale je to realita. Jedinym resenim jsou vcasne aktualizace.

 

A to v pripade Firebirdu muze byt problem z nekolik duvodu:
- nekdo se o to musi starat a to se IT oddeleni nechce

- jednotlive verze FB se casto chovaji jinak, nejde tam jen tak dat novou verzi, protoze hrozi riziko, ze se na produkcnim system neco rozbije

Kdyz toto srovnam napr. s Microsoft SQL – tam dostanu aktualizace v ramci Windows Update – to bezne IT zvladne – protoze se to dela samo.
A srovnani s Oracle? Tam naopak je potreba Oracle specialista, ktery tam bude vsechny ty patche valit a instalovat – to je na fulltime job.

 

Takze nejspis nekde odtud vitr vane – v neochote spravovat neco navic.

 

Rob

--
Tuto zprávu jste obdrželi, protože jste přihlášeni k odběru skupiny „Firebird (CZ)“ ve Skupinách Google.
Chcete-li zrušit odběr skupiny a přestat dostávat e‑maily ze skupiny, zašlete e-mail na adresu firebird_cz...@googlegroups.com.
Chcete-li tuto diskusi zobrazit na webu, navštivte https://groups.google.com/d/msgid/firebird_cz/66cef0fb-e7cf-45df-bfea-1c5e07a7ec39n%40googlegroups.com.