Multiple stack-based buffer overflows in Borland InterBase LI 8.0.0.53 through 8.1.0.253, and WI 5.1.1.680 through 8.1.0.257, allow remote…

published 2007-10-06 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-5223

cvss: 9.3; version 2.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 40.1%; EPSS 40.1% chance of exploitation in 30 days, percentile 98%
public exploits: 21; Metasploit, Exploit-DB

Multiple stack-based buffer overflows in Borland InterBase LI 8.0.0.53 through 8.1.0.253, and WI 5.1.1.680 through 8.1.0.257, allow remote attackers to execute arbitrary code via (1) a long service attach request on TCP port 3050 to the (a) SVC_attach or (b) INET_connect function, (2) a long create request on TCP port 3050 to the (c) isc_create_database or (d) jrd8_create_database function, (3) a long attach request on TCP port 3050 to the (e) isc_attach_database or (f) PWD_db_aliased function, or unspecified vectors involving the (4) jrd8_attach_database or (5) expand_filename2 function.

Timeline

2007-10-03 First public exploit (Metasploit exploit/linux/misc/ib_inet_connect)
2007-10-06 Published

Exploit prediction

40.06% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit exploit/linux/misc/ib_inet_connect Borland InterBase INET_connect() Buffer Overflow metasploit exploit, good rank, 2007-10-03
Metasploit exploit/linux/misc/ib_jrd8_create_database Borland InterBase jrd8_create_database() Buffer Overflow metasploit exploit, good rank, 2007-10-03
Metasploit exploit/linux/misc/ib_pwd_db_aliased Borland InterBase PWD_db_aliased() Buffer Overflow metasploit exploit, good rank, 2007-10-03
Metasploit exploit/windows/misc/fb_isc_attach_database Firebird Relational Database isc_attach_database() Buffer Overflow metasploit exploit, average rank, 2007-10-03
Metasploit exploit/windows/misc/fb_isc_create_database Firebird Relational Database isc_create_database() Buffer Overflow metasploit exploit, average rank, 2007-10-03
Metasploit exploit/windows/misc/fb_svc_attach Firebird Relational Database SVC_attach() Buffer Overflow metasploit exploit, average rank, 2007-10-03
Metasploit exploit/windows/misc/ib_isc_attach_database Borland InterBase isc_attach_database() Buffer Overflow metasploit exploit, good rank, 2007-10-03
Metasploit exploit/windows/misc/ib_isc_create_database Borland InterBase isc_create_database() Buffer Overflow metasploit exploit, good rank, 2007-10-03
Metasploit exploit/windows/misc/ib_svc_attach Borland InterBase SVC_attach() Buffer Overflow metasploit exploit, good rank, 2007-10-03
EDB-16844 Borland Interbase - 'INET_connect()' Remote Buffer Overflow (Metasploit) remote, 2010-07-03
EDB-16843 Borland Interbase - 'jrd8_create_database()' Remote Buffer Overflow (Metasploit) remote, 2010-07-03
EDB-16839 Borland Interbase - 'PWD_db_aliased()' Remote Buffer Overflow (Metasploit) remote, 2010-07-03
EDB-16449 Borland Interbase - 'SVC_attach()' Remote Buffer Overflow (Metasploit) remote, 2010-07-03
EDB-16447 Borland Interbase - 'isc_attach_database()' Remote Buffer Overflow (Metasploit) remote, 2010-07-03
EDB-16440 Firebird Relational Database - 'isc_attach_database()' Remote Buffer Overflow (Metasploit) remote, 2010-07-03
EDB-16437 Borland Interbase - 'isc_create_database()' Remote Buffer Overflow (Metasploit) remote, 2010-07-03
EDB-16432 Firebird Relational Database - 'isc_create_database()' Remote Buffer Overflow (Metasploit) remote, 2010-07-03
EDB-16420 Firebird Relational Database - 'SVC_attach()' Remote Buffer Overflow (Metasploit) remote, 2010-07-03
EDB-10021 Borland Interbase 2007/2007 SP2 - 'INET_connect' Remote Buffer Overflow (Metasploit) remote, 2007-10-03
EDB-10020 Borland Interbase 2007/2007 SP2 - 'jrd8_create_database' Remote Buffer Overflow (Metasploit) remote, 2007-10-03
EDB-9954 Borland Interbase 2007 - 'PWD_db_aliased' Remote Buffer Overflow (Metasploit) remote, 2007-10-03
securityfocus.com http://www.securityfocus.com/bid/25917 referenced PoC, tagged "exploit" by a source, unverified
risesecurity.org http://risesecurity.org/exploit/9/ referenced PoC, tagged "exploit" by a source, unverified
risesecurity.org http://risesecurity.org/exploit/15/ referenced PoC, tagged "exploit" by a source, unverified
risesecurity.org http://risesecurity.org/exploit/14/ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	2.0	9.3	AV:N/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

securityfocus.com /bid/25917
vdb-entry, exploit
risesecurity.org /exploit/9/
exploit
risesecurity.org /exploit/15/
exploit
risesecurity.org /exploit/14/
exploit
risesecurity.org /blog/entry/3/
securitytracker.com /id?1018772
vdb-entry
risesecurity.org /exploit/10/
osvdb.org /38607
vdb-entry
osvdb.org /38609
vdb-entry
risesecurity.org /exploit/13/
vupen.com /english/advisories/2007/3381
vdb-entry
osvdb.org /38606
vdb-entry
exchange.xforce.ibmcloud.com /vulnerabilities/36956
vdb-entry
osvdb.org /38608
vdb-entry
risesecurity.org /advisory/RISE-2007002/
secunia.com /advisories/27058
third-party-advisory
risesecurity.org /exploit/12/
osvdb.org /38605
vdb-entry

Sources

CVE List CVE-2007-5243
NVD CVE-2007-5243

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary