Vulnerability record · CVE-2007-3566 · published 26 July 2007
CVE-2007-3566: Borland InterBase database service stack buffer overflow via create request
BBorland Software · Interbase
The database service ibserver.exe in Borland InterBase 2007 before SP2 has a stack-based buffer overflow triggered by a long size value in a create request to port 3050/tcp. A remote, unauthenticated attacker can send a crafted request that overflows a stack buffer, which can lead to arbitrary code execution on the database server.
Description
Stack-based buffer overflow in the database service (ibserver.exe) in Borland InterBase 2007 before SP2 allows remote attackers to execute arbitrary code via a long size value in a create request to port 3050/tcp.
AV:N/AC:L/Au:N/C:P/I:P/A:P
Automated analysis
high priorityRemote unauthenticated code execution with a high EPSS score and a CVSS 2.0 base of 7.5, though no KEV listing or confirmed in-the-wild exploitation is recorded.
What it is
The database service ibserver.exe in Borland InterBase 2007 before SP2 has a stack-based buffer overflow triggered by a long size value in a create request to port 3050/tcp. A remote, unauthenticated attacker can send a crafted request that overflows a stack buffer, which can lead to arbitrary code execution on the database server.
Impact
Successful exploitation lets a remote attacker execute arbitrary code with the privileges of the InterBase service, potentially giving full control of the database host and its data.
Attack surface
Reachable over the network on port 3050/tcp through the InterBase database service; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV and no public exploit references are tagged in the record, but EPSS is high (0.66081, 99.2nd percentile), indicating elevated likelihood of exploitation activity.
What to do
- Apply the Borland/CodeGear InterBase 2007 SP2 or later update referenced in the vendor and TippingPoint advisories.
- Restrict network access to port 3050/tcp to trusted hosts only, using firewall or ACL rules.
- Run the InterBase service with least privilege and isolate the database host from untrusted networks.
- Monitor vendor advisories for further patches and confirm the installed InterBase build is not a pre-SP2 release.
Detection
- Inspect network traffic to port 3050/tcp for create requests containing unusually large size values.
- Monitor InterBase service (ibserver.exe) for crashes or abnormal process termination that may indicate a failed overflow attempt.
- Review host logs for unexpected child processes or code execution spawned by the database service account.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2007-3566 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2007-3566), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
