Back to Database
Status published
Medium
CVE-2013-2492
Stack-based buffer overflow in Firebird 2.1.3 through 2.1.5 before 18514,...
Vulnerability Description
Stack-based buffer overflow in Firebird 2.1.3 through 2.1.5 before 18514, and 2.5.1 through 2.5.3 before 26623, on Windows allows remote attackers to execute arbitrary code via a crafted packet to TCP port 3050, related to a missing size check during extraction of a group number from CNCT information.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2013-2492
Credits & Attribution
No credits recorded in the NVD database.
References
- https://security.gentoo.org/glsa/201512-11
- https://gist.github.com/zeroSteiner/85daef257831d904479c
- http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00036.html
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/misc/fb_cnct_group.rb
- http://www.securityfocus.com/bid/58393
- http://www.debian.org/security/2013/dsa-2648
- http://tracker.firebirdsql.org/browse/CORE-4058
- http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00039.html
- http://www.debian.org/security/2013/dsa-2647
More from firebirdsql
View All →CVE-2017-6369
Insufficient checks in the UDF subsystem in Firebird 2.5.x before...
High
8.8
CVE-2016-1569
FireBird 2.5.5 allows remote authenticated users to cause a denial...
Medium
6.5
CVE-2014-9323
The xdr_status_vector function in Firebird before 2.1.7 and 2.5.x before...
Medium
5
CVE-2012-5529
TraceManager in Firebird 2.5.0 and 2.5.1, when trace is enabled,...
Low
3.5
CVE-2009-2620
src/remote/server.cpp in fbserver.exe in Firebird SQL 1.5 before 1.5.6, 2.0...
Medium
5
Affected Vendor
firebirdsql
View all reports →Affected Software
firebird
Vulnerable Versions:
2.1.3, 2.1.4, 2.1.5, 2.5.1, 2.5.2, 2.5.3
Timeline
Official Publish:
March 15th, 2013
Last Modified:
August 6th, 2024
Added to House:
July 19th, 2026
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.