1. Introduction
Pervasive PSQL / Btrieve Server Detection identifies instances of Pervasive PSQL / Btrieve running on a remote host. This database engine is commonly used in older business applications, particularly those developed for Windows environments. Its exposure to the internet or untrusted networks can allow unauthorised access to sensitive data. A successful exploit could compromise confidentiality, integrity and availability of the database.
2. Technical Explanation
Pervasive PSQL / Btrieve listens on a network port for client connections. If not properly secured, anyone able to connect to that port may be able to access the database. There is no specific CVE currently associated with this detection; it represents an information disclosure risk due to potential misconfiguration. An attacker could attempt to connect using standard PSQL/Btrieve clients or tools to enumerate data and potentially execute commands.
- Root cause: The Pervasive PSQL / Btrieve server is listening on a network interface without sufficient access controls.
- Exploit mechanism: An attacker connects to the open port, attempts default credentials, and then uses standard database commands to extract data or modify the database.
- Scope: Windows systems running Pervasive PSQL / Btrieve versions prior to 11 are likely affected.
3. Detection and Assessment
Confirming a vulnerable system involves checking for the listening service and identifying its version. A thorough assessment includes attempting basic enumeration.
- Quick checks: Use PowerShell to check for listening ports associated with Pervasive PSQL/Btrieve (typically port 3300).
- Scanning: Nessus vulnerability ID 2c579948 can identify this issue. Other scanners may have similar signatures.
- Logs and evidence: Check Windows Event Logs for connections to the Pervasive PSQL / Btrieve service, particularly failed login attempts.
netstat -an | findstr "3300"4. Solution / Remediation Steps
Fixing this issue involves limiting network access to the Pervasive PSQL / Btrieve port or removing the service if it is not required.
4.1 Preparation
- Ensure you have access to restore the database if needed. A roll back plan involves restoring from backup or restarting the service with its original configuration.
- Changes should be made during a scheduled maintenance window, and approved by the IT security team.
4.2 Implementation
- Step 1: Configure the Windows Firewall to block incoming connections to port 3300 except from trusted sources.
- Step 2: If the service is not required, uninstall Pervasive PSQL / Btrieve.
4.3 Config or Code Example
Before
netstat -an | findstr "3300" (shows port 3300 listening on all interfaces)After
netstat -an | findstr "3300" (should show no listening instances, or only listen on localhost)4.4 Security Practices Relevant to This Vulnerability
List only practices that directly address this vulnerability type. Use neutral wording and examples instead of fixed advice. For example: least privilege, input validation, safe defaults, secure headers, patch cadence. If a practice does not apply, do not include it.
- Practice 1: Least privilege – limit network access to only those systems that require connectivity to the database server.
- Practice 2: Network segmentation – isolate the database server on a separate network segment with strict firewall rules.
4.5 Automation (Optional)
# PowerShell example to block port 3300 with Windows Firewall
New-NetFirewallRule -DisplayName "Block Pervasive PSQL/Btrieve" -Direction Inbound -LocalPort 3300 -Action Block5. Verification / Validation
Confirm the fix by checking that port 3300 is no longer accessible from untrusted networks and verifying database functionality.
- Post-fix check: Run `netstat -an | findstr “3300”` again; it should show no listening instances on public interfaces.
- Re-test: Re-run the Nessus scan (ID 2c579948) to confirm that the vulnerability is no longer detected.
- Smoke test: Verify that any applications using the database can still connect and function correctly.
- Monitoring: Monitor Windows Firewall logs for blocked connections on port 3300 as an indicator of attempted access.
netstat -an | findstr "3300" (should show no listening instances)6. Preventive Measures and Monitoring
Suggest only measures that are relevant to the vulnerability type. Use “for example” to keep advice conditional, not prescriptive.
- Baselines: Update security baselines or policies to include a requirement for restricting access to database ports.
- Asset and patch process: Implement a regular asset discovery process to identify all running services, including older applications like Pervasive PSQL / Btrieve.
7. Risks, Side Effects, and Roll Back
- Risk or side effect 2: Service disruption – uninstalling Pervasive PSQL / Btrieve will disrupt any applications relying on it.
- Roll back: Restore the database from backup if necessary. Reinstall Pervasive PSQL / Btrieve and revert any firewall changes.
8. References and Resources
- Vendor advisory or bulletin: http://www.nessus.org/u?2c579948