CVE-2008-0387: Firebird SQL XDR request integer overflow allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityNetwork-reachable, unauthenticated memory corruption in a database server with a high EPSS score, though no KEV listing or confirmed in-the-wild exploitation is recorded.

What it is

Firebird SQL 1.0.3 and earlier, 1.5.x before 1.5.6, 2.0.x before 2.0.4, and 2.1.x before 2.1.0 RC1 contain an integer overflow in the handling of crafted XDR requests (op_receive, op_start, op_start_and_receive, op_send, op_start_and_send, op_start_send_and_receive) that triggers memory corruption. The flaw is remotely reachable over the network without authentication, so any exposed Firebird listener is at risk.

Impact

An attacker can corrupt memory in the Firebird server process, which the record states might allow execution of arbitrary code. The CVSS vector shows a full availability impact with no confidentiality or integrity impact recorded.

Attack surface

Reached over the network via the Firebird wire protocol by sending crafted XDR operation requests; the AV:N/AC:L/Au:N vector indicates no authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV and no ransomware usage is documented; EPSS is 0.45873 (98.7th percentile), and references are advisory and VDB entries only, with no public exploit tag.

What to do

• Upgrade Firebird to a fixed release: 1.5.6 or later, 2.0.4 or later, or 2.1.0 RC1 or later, per the vendor advisory CORE-1681.
• Apply the distribution patches referenced by the Debian DSA-1529 and Gentoo GLSA 200803-02 advisories if you run packaged Firebird.
• Restrict network access to the Firebird port (default 3050) to trusted hosts only, and never expose it to the internet.
• Run the Firebird service with least privilege and isolate it from other critical services to limit the effect of memory corruption.
• Monitor vendor and distribution advisories for this legacy branch, since the affected versions are long out of support.

Detection

• Alert on Firebird connections from unexpected or external source addresses, especially to port 3050.
• Monitor Firebird server logs and process crashes or restarts that could indicate memory corruption from malformed XDR requests.
• Use network IDS signatures for malformed Firebird XDR operation packets if available for your sensor set.
• Track Firebird version inventory to confirm no host still runs 1.0.3, 1.5.x before 1.5.6, 2.0.x before 2.0.4, or 2.1.x before 2.1.0 RC1.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.