An unauthenticated remote attacker can cause a denial of service in Firebird database servers by sending a specially crafted slice packet that triggers a division by zero error.

The vulnerability exists in the sdl_desc function, which fails to validate the length of a decoded SDL descriptor from a slice packet. This allows an unauthenticated attacker to trigger a division by zero error, resulting in a server crash.

The successful exploitation of this vulnerability results in a denial of service, rendering the database unavailable to legitimate users and applications. With a CVSS score of 7.5, this high-severity flaw poses a significant risk to business continuity, particularly for critical systems relying on Firebird for transaction processing or data management.

Immediate Action: Upgrade to Firebird versions 3.0.14, 4.0.7, or 5.0.4 as appropriate for your current deployment to resolve the underlying logic error.

Proactive Monitoring: Monitor server logs for unexpected service restarts or frequent connection drops that may indicate attempts to crash the database service.

Compensating Controls: Deploy a network-level firewall or intrusion prevention system to filter traffic and block malformed packets directed at the Firebird database port.

Public Exploit Available: Unknown

Given the ease of exploitation and the potential for service disruption, administrators should prioritize patching Firebird instances to the specified fixed versions. Updating the database software is the only definitive method to eliminate the risk of denial of service attacks targeting this specific vulnerability.