Bug 1305820 (CVE-2015-7036)

Summary:	CVE-2015-7036 sqlite: arbitrary code execution on databases with malformed schema
Product:	[Other] Security Response	Reporter:	Martin Prpič <mprpic>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	alex, bazanluis20, databases-maint, jstanek, mdshaikh, redhat-bugzilla, slawomir, wilmer5
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-06-14 10:07:33 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1305822, 1305823, 1305825
Bug Blocks:	1305827

Description Martin Prpič 2016-02-09 10:33:06 UTC

It is possible to craft SQLite databases that, when opened by an application expecting a specific SQL schema, could cause arbitrary code execution.

The issue is in the handling of the fts3_tokenizer function:

https://www.sqlite.org/mark/fts3.html?FTS+does+not&If+the+fts3*callback#mark

Yum might be affected, but due to the use of HTTPS in RHEL, and in Fedora, the digest from the mirror list service should
protect clients.

The issue does not appear to be fixed upstream yet:

https://www.sqlite.org/src/finfo?name=ext/fts3/fts3_tokenizer.c&ci=trunk

External References:

http://zerodayinitiative.com/advisories/ZDI-15-570/

Comment 1 Martin Prpič 2016-02-09 10:34:49 UTC

Created sqlite2 tracking bugs for this issue:

Affects: fedora-all [bug 1305823]
Affects: epel-all [bug 1305825]

Comment 2 Martin Prpič 2016-02-09 10:34:56 UTC

Created sqlite tracking bugs for this issue:

Affects: fedora-all [bug 1305822]

Comment 5 Martin Prpič 2016-02-18 09:28:17 UTC

This issue has been fixed in the 3.11.0 release of sqlite:

https://www.sqlite.org/releaselog/3_11_0.html

"Because of continuing security concerns, the two-argument version of the seldom-used and little-known fts3_tokenizer() function is disabled unless SQLite is compiled with the SQLITE_ENABLE_FTS3_TOKENIZER."

Comment 6 Stefan Cornelius 2016-06-14 10:02:49 UTC

Statement:

This issue did not affect the versions of sqlite as shipped with Red Hat Enterprise Linux 5 and 6.

Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.