Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Remote code execution vulnerability in SQLite

blade.tencent.com

Post reply on HN
Print view View original

1–10 of 161 posts

Re: Remote code execution vulnerability in SQLite

#6

Post by rhexs »

"If you use a device or software that uses SQLite or Chromium, it will be affected."

If I write a hello world C program that does some sort of IO with SQLite, it will be vulnerable to remote code execution? (if this turns out to be true, that will be quite impressive!)

Guessing something was lost in translation there. Sounds more like someone found a way to get code execution if you can inject certain data into SQLite, then found various applications that expose this functionality remotely?

Re: Remote code execution vulnerability in SQLite

#7

Post by dorianm »

saagarjha wrote: post #5
devy wrote: post #3

Earlier quoted context omitted.

Yeah, I was hoping to find a CVE number but couldn't

Has there been a CVE number assigned yet?

I don't see any: https://www.cvedetails.com/vulnerability-list/vendor_id-9237...

Edit: it's "To be allocated": "[$TBD][900910] High To be allocated: Multiple issues in SQLite via WebSQL. Reported by Wenxiang Qian of Tencent Blade Team on 2018-11-01" (from https://chromereleases.googleblog.com/2018/12/stable-channel...)

Re: Remote code execution vulnerability in SQLite

#8

Post by cdelsolar »

saagarjha wrote: post #2

Unfortunately this announcement is light on details; does anybody know what the actual vulnerability was?

They say to update to this SQLite version: https://www.sqlite.org/releaselog/3_26_0.html

Skimming that log doesn't give me any ideas.. maybe the diff would help elucidate?

Re: Remote code execution vulnerability in SQLite

#9

Post by Serow225 »

cdelsolar wrote: post #8
saagarjha wrote: post #2

Unfortunately this announcement is light on details; does anybody know what the actual vulnerability was?

They say to update to this SQLite version: https://www.sqlite.org/releaselog/3_26_0.html Skimming that log doesn't give me any ideas.. maybe the diff would help elucidate?

Maybe related to this, as a guess? https://www.sqlite.org/c3ref/c_dbconfig_defensive.html#sqlit...

SQLITE_DBCONFIG_DEFENSIVE The SQLITE_DBCONFIG_DEFENSIVE option activates or deactivates the "defensive" flag for a database connection. When the defensive flag is enabled, language features that allow ordinary SQL to deliberately corrupt the database file are disabled. The disabled features include but are not limited to the following: The PRAGMA writable_schema=ON statement. Writes to the sqlite_dbpage virtual table. Direct writes to shadow tables.

Re: Remote code execution vulnerability in SQLite

#10

Post by sebazzz »

rhexs wrote: post #6

"If you use a device or software that uses SQLite or Chromium, it will be affected." If I write a hello world C program that does some sort of IO with SQLite, it will be vulnerable to remote code execution? (if this turns out to be true, that will be quite impressive!) Guessing something was lost in translation there. Sounds more like someone found a way to get code execution if you can inject certain data into SQLit…

Probably they found the vulnerability through Chromium, then extended that to "everything that uses SQLite". Hard to tell anything without more details though.

But if that is the case this is huge. SQLite is used in many places nowadays: Websites, browsers (Chromium and Firefox, I know of), various software including some Android apps. That also probably means the attack vector is some procedure where input is sanitized (assuming SQLite provides that, I never programmed against the C API).

Post reply on HN