CVE-2026-34232
Description
A flaw was found in Firebird, an open-source relational database management system. The xdr_status_vector() function, responsible for decoding server responses, does not properly handle a specific data type (isc_arg_cstring) within an op_response packet. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted op_response packet to the server, leading to a server crash and a Denial of Service (DoS).
Statement
Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.
Mitigation
To mitigate this issue, restrict network access to the Firebird database server. Configure firewall rules to limit incoming connections to the Firebird service (port 3050 by default) only from trusted hosts or subnets.
Example using `firewalld`:
`firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="<TRUSTED_IP_OR_SUBNET>" port port="3050" protocol="tcp" accept'`
`firewall-cmd --reload`
Alternatively, if Firebird is only accessed locally, restrict it to the localhost interface.
`firewall-cmd --permanent --zone=public --remove-port=3050/tcp`
`firewall-cmd --permanent --zone=trusted --add-source=127.0.0.1`
`firewall-cmd --permanent --zone=trusted --add-port=3050/tcp`
`firewall-cmd --reload`
Note that applying firewall rules may require a service reload or restart to take full effect and could impact legitimate client connections if not configured correctly.
Understanding the Weakness (CWE)
Integrity,Other
Technical Impact: Varies by Context; Unexpected State
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
