Critical Path traversal when declaring external routine, also existing on Firebird 2.x?

[Memo99]

Hi Community,

does the critical CVE also affect the v2.x? Since the PluginManager came after version 3.x.

[AlexPeshkoff]

As far as I know nobody used to check it in unsupported version. There is minimal reproduction in GHSA-7pxc-h3rv-r257, you may try yourself.

PS. Using FB2 without good firewall protection is anyway bad idea. And if you have well-tuned protection bug becomes not so critical?

[dyemanov]

IIRC, there are no external routines in v2.x.

[mrotteveel]

Although Firebird 2.x doesn't have external routines, UDF have a similar flaw.

That said, Firebird 2.5 has been end-of-life since June 2019: if you care about security, it is high time you upgrade.

[dyemanov]

For UDFs this is well-known issue which was fixed decades ago -- UdfAccess and ExternalFileAccess are defaulted to safe values.

[aafemt]

Besides, UDF handling code normalize path instead of simple concatenation.

[Memo99]

Thanks guys, it helped a lot.