Firebird: DoS via `op_response` packet from client

Firebird的CVE-2026-34232影响5.0.4、4.0.7及3.0.14之前的版本。这是由于xdrstatusvector()函数中的一个缺陷，该函数在解码opresponse数据包时未能正确处理iscargcstring数据类型。如果状态向量中遇到恶意数据包，这可能导致服务器崩溃。该漏洞的严重程度在CVSS量表上评为7.5，表明中等风险。未经身份验证的攻击者可以通过向服务器发送专门制作的opresponse数据包来利用此漏洞。缺乏适当的输入验证允许潜在的恶意代码执行。

Organizations utilizing Firebird databases in production environments, particularly those with external network access or legacy configurations that haven't been regularly patched, are at risk. Shared hosting environments where multiple users share a single Firebird instance are also particularly vulnerable, as a compromised user could potentially exploit this vulnerability to impact other users.

• linux / server: Monitor Firebird logs for errors related to iscargcstring or op_response packet processing. Use journalctl -u firebird to filter for relevant log entries.

journalctl -u firebird | grep -i "isc_arg_cstring"

• database (mysql): While this is a Firebird vulnerability, monitor network traffic to the Firebird instance (port 3050) for unusual connection attempts or malformed packets using tools like tcpdump or Wireshark. • generic web: If Firebird is exposed via a web application, monitor web server access logs for requests originating from suspicious IP addresses or exhibiting unusual patterns.

 grep "Firebird" /var/log/apache2/access.log

1. 2026-04-17Disclosure

   disclosure

1. 已保留2026-03-26
2. 发布日期2026-04-17
3. 修改日期2026-04-20
4. EPSS 更新日期2026-04-25

减轻CVE-2026-34232的解决方案是将Firebird升级到已修补的版本。版本5.0.4、4.0.7和3.0.14包含必要的修复。强烈建议尽快应用此更新以保护您的系统。此外，请审查网络安全策略，以确保仅允许来自受信任来源访问Firebird。监控Firebird服务器日志以查找可疑活动可以帮助检测和响应潜在的利用尝试。定期应用安全补丁是维护系统安全的基本实践。