Subject | IB Security Back Door and Preventing Network Access |
---|---|
Author | rstitt@kcp.com |
Post date | 2001-01-16T20:32:20Z |
I had a couple of questions about the recently announced security problem
in IB (I posted this a few days ago on the ib@mers list-but got no
response, so I thought I'd try here):
First, under earlier versions of IB, it was necessary to use a license key
to determine what level of access was purchased and, thus, available. I
believe one option was "local access only" (i.e., no outside connectivity).
Would obtaining and using that type of license prevent the exploitation of
the documented back door? I realize this would be a problem for databases
that needed to be networked to other clients, but might it work for
stand-alone applications that reside on the same system (NT based) as the
database server??
Second, is it possible to restrict access to the Firebird or IB 6 databases
in a similar manner (i.e., only allow clients to connect locally to the
database from the same machine-no TCP or other network connections)??
Thanks,
...Rob
in IB (I posted this a few days ago on the ib@mers list-but got no
response, so I thought I'd try here):
First, under earlier versions of IB, it was necessary to use a license key
to determine what level of access was purchased and, thus, available. I
believe one option was "local access only" (i.e., no outside connectivity).
Would obtaining and using that type of license prevent the exploitation of
the documented back door? I realize this would be a problem for databases
that needed to be networked to other clients, but might it work for
stand-alone applications that reside on the same system (NT based) as the
database server??
Second, is it possible to restrict access to the Firebird or IB 6 databases
in a similar manner (i.e., only allow clients to connect locally to the
database from the same machine-no TCP or other network connections)??
Thanks,
...Rob