A critical denial of service vulnerability in Firebird allows unauthenticated attackers to crash the database server by sending malformed packets.

The vulnerability exists in the xdr_status_vector function, which improperly handles the isc_arg_cstring type during packet decoding. An unauthenticated attacker can exploit this flaw by sending a specially crafted op_response packet, resulting in a server crash and subsequent denial of service.

The vulnerability carries a CVSS score of 7.5, reflecting a significant risk to service availability. Successful exploitation results in the immediate termination of the database process, leading to unplanned downtime for any applications relying on the Firebird database. This can disrupt critical business operations, halt data processing, and impact user accessibility until the service is manually restarted by administrative staff.

Immediate Action: Upgrade all instances of Firebird to version 3.0.14, 4.0.7, or 5.0.4, depending on the current branch in use.

Proactive Monitoring: Monitor server logs for frequent service restarts or unexpected process terminations that may indicate an ongoing exploitation attempt.

Compensating Controls: Deploy a network-based firewall or an intrusion detection system to filter or block suspicious traffic directed at the Firebird database port, specifically looking for malformed op_response packets.

Public Exploit Available: Unknown.

Given the ease of exploitation and the potential for severe service disruption, organizations should prioritize patching affected Firebird instances. IT administrators should verify their current version strings and apply the vendor-provided updates immediately to prevent potential denial of service attacks against their database infrastructure.