CVE Feed

    Dashboard / CVE / CVE-2013-2492

    CVE-2013-2492

    Stack-based buffer overflow in Firebird 2.1.3 through 2.1.5 before 18514, and 2.5.1 through 2.5.3 before 26623, on Windows allows remote attackers to execute arbitrary code via a crafted packet to TCP port 3050, related to a missing size check during extraction of a group number from CNCT information.

    Published:Mar 15, 2013
    Last Modified:Apr 11, 2025
    EPS:Mar 15, 2013
    EPSS Score:0.85258
    CVSS Score:6.8

    Affected Products

    Vendor
    Firebirdsql
    Product
    Firebird
    Vendor
    Microsoft
    Product
    Windows

    Exploits

    http://tracker.firebirdsql.org/browse/CORE-4058https://gist.github.com/zeroSteiner/85daef257831d904479chttps://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/misc/fb_cnct_group.rbhttp://tracker.firebirdsql.org/browse/CORE-4058https://gist.github.com/zeroSteiner/85daef257831d904479chttps://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/misc/fb_cnct_group.rbhttps://www.exploit-db.com/exploits/41709

    Related CVEs

    CVE-2026-40342 (CVSS 9.9) — Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14…
    CVE-2026-35215 (CVSS 7.5) — Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14…
    CVE-2026-34232 (CVSS 7.5) — Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14…
    CVE-2026-33337 (CVSS 7.5) — Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14…
    CVE-2026-28224 (CVSS 8.2) — Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14…
    CVE-2026-28214 (CVSS 6) — Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14…
    CVE-2026-27890 (CVSS 8.2) — Firebird is an open-source relational database management system. In versions prior to 5.0.4, 4.0.7 and 3.0.14…
    CVE-2026-28212 (CVSS 7.5) — Firebird is an open-source relational database management system. In versions prior to 6.0.0, 5.0.4, 4.0.7 and…
    CVE-2025-65104 (CVSS 7.9) — Firebird is an open-source relational database management system. In versions FB3 of the client library placed…
    CVE-2025-24975 (CVSS 7.1) — Firebird is a relational database. Prior to snapshot versions 4.0.6.3183, 5.0.2.1610, and 6.0.0.609, Firebird …

    References

    http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00036.html
    http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00039.html
    http://tracker.firebirdsql.org/browse/CORE-4058
    http://www.debian.org/security/2013/dsa-2647
    http://www.debian.org/security/2013/dsa-2648
    http://www.securityfocus.com/bid/58393
    https://gist.github.com/zeroSteiner/85daef257831d904479c
    https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/misc/fb_cnct_group.rb
    https://security.gentoo.org/glsa/201512-11
    http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00036.html
    http://lists.opensuse.org/opensuse-security-announce/2013-03/msg00039.html
    http://tracker.firebirdsql.org/browse/CORE-4058
    http://www.debian.org/security/2013/dsa-2647
    http://www.debian.org/security/2013/dsa-2648
    http://www.securityfocus.com/bid/58393
    https://gist.github.com/zeroSteiner/85daef257831d904479c
    https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/misc/fb_cnct_group.rb
    https://security.gentoo.org/glsa/201512-11

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High