Bug 1305820 - (CVE-2015-7036) CVE-2015-7036 sqlite: arbitrary code execution on databases with malformed schema
CVE-2015-7036 sqlite: arbitrary code execution on databases with malformed sc...
Status: CLOSED WONTFIX
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20151123,repor...
: Security
Depends On: 1305822 1305823 1305825
Blocks: 1305827
  Show dependency treegraph
 
Reported: 2016-02-09 05:33 EST by Martin Prpič
Modified: 2017-02-07 14:00 EST (History)
8 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-06-14 06:07:33 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Martin Prpič 2016-02-09 05:33:06 EST
It is possible to craft SQLite databases that, when opened by an application expecting a specific SQL schema, could cause arbitrary code execution.

The issue is in the handling of the fts3_tokenizer function:

https://www.sqlite.org/mark/fts3.html?FTS+does+not&If+the+fts3*callback#mark

Yum might be affected, but due to the use of HTTPS in RHEL, and in Fedora, the digest from the mirror list service should
protect clients.

The issue does not appear to be fixed upstream yet:

https://www.sqlite.org/src/finfo?name=ext/fts3/fts3_tokenizer.c&ci=trunk

External References:

http://zerodayinitiative.com/advisories/ZDI-15-570/
Comment 1 Martin Prpič 2016-02-09 05:34:49 EST
Created sqlite2 tracking bugs for this issue:

Affects: fedora-all [bug 1305823]
Affects: epel-all [bug 1305825]
Comment 2 Martin Prpič 2016-02-09 05:34:56 EST
Created sqlite tracking bugs for this issue:

Affects: fedora-all [bug 1305822]
Comment 5 Martin Prpič 2016-02-18 04:28:17 EST
This issue has been fixed in the 3.11.0 release of sqlite:

https://www.sqlite.org/releaselog/3_11_0.html

"Because of continuing security concerns, the two-argument version of the seldom-used and little-known fts3_tokenizer() function is disabled unless SQLite is compiled with the SQLITE_ENABLE_FTS3_TOKENIZER."
Comment 6 Stefan Cornelius 2016-06-14 06:02:49 EDT
Statement:

This issue did not affect the versions of sqlite as shipped with Red Hat Enterprise Linux 5 and 6.

Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Note You need to log in before you can comment on or make changes to this bug.