Remote code execution vulnerability in SQLite
blade.tencent.com
Remote code execution vulnerability in SQLite
1–10 of 161 posts
Re: Remote code execution vulnerability in SQLite
#2Unfortunately this announcement is light on details; does anybody know what the actual vulnerability was?
Re: Remote code execution vulnerability in SQLite
#3Unfortunately this announcement is light on details; does anybody know what the actual vulnerability was?
Yeah, I was hoping to find a CVE number but couldn't
Re: Remote code execution vulnerability in SQLite
#4Pretty sparse on details. I presume local SQLite files for backend systems are unaffected, can anyone confirm?
Re: Remote code execution vulnerability in SQLite
#5Re: Remote code execution vulnerability in SQLite
#6"If you use a device or software that uses SQLite or Chromium, it will be affected."
If I write a hello world C program that does some sort of IO with SQLite, it will be vulnerable to remote code execution? (if this turns out to be true, that will be quite impressive!)
Guessing something was lost in translation there. Sounds more like someone found a way to get code execution if you can inject certain data into SQLite, then found various applications that expose this functionality remotely?
Re: Remote code execution vulnerability in SQLite
#7Earlier quoted context omitted.
Yeah, I was hoping to find a CVE number but couldn't
Has there been a CVE number assigned yet?
I don't see any: https://www.cvedetails.com/vulnerability-list/vendor_id-9237...
Edit: it's "To be allocated": "[$TBD][900910] High To be allocated: Multiple issues in SQLite via WebSQL. Reported by Wenxiang Qian of Tencent Blade Team on 2018-11-01" (from https://chromereleases.googleblog.com/2018/12/stable-channel...)
Re: Remote code execution vulnerability in SQLite
#8Unfortunately this announcement is light on details; does anybody know what the actual vulnerability was?
They say to update to this SQLite version: https://www.sqlite.org/releaselog/3_26_0.html
Skimming that log doesn't give me any ideas.. maybe the diff would help elucidate?
Re: Remote code execution vulnerability in SQLite
#9Unfortunately this announcement is light on details; does anybody know what the actual vulnerability was?
They say to update to this SQLite version: https://www.sqlite.org/releaselog/3_26_0.html Skimming that log doesn't give me any ideas.. maybe the diff would help elucidate?
Maybe related to this, as a guess?
https://www.sqlite.org/c3ref/c_dbconfig_defensive.html#sqlit...
SQLITE_DBCONFIG_DEFENSIVE The SQLITE_DBCONFIG_DEFENSIVE option activates or deactivates the "defensive" flag for a database connection. When the defensive flag is enabled, language features that allow ordinary SQL to deliberately corrupt the database file are disabled. The disabled features include but are not limited to the following: The PRAGMA writable_schema=ON statement. Writes to the sqlite_dbpage virtual table. Direct writes to shadow tables.
Re: Remote code execution vulnerability in SQLite
#10"If you use a device or software that uses SQLite or Chromium, it will be affected." If I write a hello world C program that does some sort of IO with SQLite, it will be vulnerable to remote code execution? (if this turns out to be true, that will be quite impressive!) Guessing something was lost in translation there. Sounds more like someone found a way to get code execution if you can inject certain data into SQLit…
Probably they found the vulnerability through Chromium, then extended that to "everything that uses SQLite". Hard to tell anything without more details though.
But if that is the case this is huge. SQLite is used in many places nowadays: Websites, browsers (Chromium and Firefox, I know of), various software including some Android apps. That also probably means the attack vector is some procedure where input is sanitized (assuming SQLite provides that, I never programmed against the C API).