928700 – (CVE-2015-3414) VUL-1: CVE-2015-3414: sqlite3,sqlite2: dequoting of collation-sequence names

Bug 928700 (CVE-2015-3414) - VUL-1: CVE-2015-3414: sqlite3,sqlite2: dequoting of collation-sequence names

Summary: VUL-1: CVE-2015-3414: sqlite3,sqlite2: dequoting of collation-sequence names

Status:	RESOLVED FIXED

Alias:	CVE-2015-3414

Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents (show other bugs)
Version:	unspecified
Hardware:	Other Other

Priority:	P4 - Low Severity: Normal
Target Milestone:	---
Deadline:	2016-07-18
Assignee:	Security Team bot
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/116275/
Whiteboard:	CVSSv3.1:SUSE:CVE-2015-3414:4.4:(AV:...
Keywords:

Depends on:
Blocks:

Clone This Bug

Reported:	2015-04-27 08:38 UTC by Andreas Stieger
Modified:	2022-02-13 10:47 UTC (History)
CC List:	7 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
upstream patch (7.29 KB, patch) 2019-11-04 14:42 UTC, Wolfgang Frisch	Details \| Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Andreas Stieger 2015-04-27 08:38:13 UTC

SQLite before 3.8.9 does not properly implement the dequoting of
collation-sequence names, which allows context-dependent attackers to cause a
denial of service (uninitialized memory access and application crash) or
possibly have unspecified other impact via a crafted COLLATE clause, as
demonstrated by COLLATE"""""""" at the end of a SELECT statement.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3414
http://www.cvedetails.com/cve/CVE-2015-3414/
http://seclists.org/fulldisclosure/2015/Apr/31
https://www.sqlite.org/src/info/eddc05e7bb31fae74daa86e0504a3478b99fa0f2
http://www.sqlite.org/releaselog/3_8_9.html

bug CVE-2015-3414, bug CVE-2015-3415 and bug CVE-2015-3416 go together.

Comment 1 Andreas Stieger 2015-04-27 09:34:13 UTC

bug 928700, bug 928701, bug 928702 all affect the query parser. This is typically exposed to and queries not supplied by users/remotely, except in WebDB / WebSQL like systems mentioned in http://seclists.org/fulldisclosure/2015/Apr/31

Comment 2 Swamp Workflow Management 2015-04-27 22:00:18 UTC

bugbot adjusting priority

Comment 3 Reinhard Max 2016-03-24 14:33:31 UTC

Can we close this and its siblings?

Comment 5 Swamp Workflow Management 2016-07-04 11:18:36 UTC

An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2016-07-18.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/62888

Comment 6 Marcus Meissner 2019-05-29 06:44:47 UTC

I think we covered most of it with version updates already.

Comment 7 Wolfgang Frisch 2019-11-04 14:42:20 UTC

All code streams are either fixed or not affected, except:

SUSE:SLE-12:Update sqlite3

Comment 8 Wolfgang Frisch 2019-11-04 14:42:51 UTC

Created attachment 823268 [details]
upstream patch

https://www.sqlite.org/src/info/eddc05e7bb31fae7

Comment 9 Reinhard Max 2019-11-18 14:01:12 UTC

I guess we can close this based on what you said about SUSE:SLE-12:Update in bug 928701 comment 9.

Comment 10 Swamp Workflow Management 2021-07-14 20:03:56 UTC

SUSE-SU-2021:2320-1: An update that fixes 21 vulnerabilities, contains one feature is now available.

Category: security (important)
Bug References: 1157818,1158812,1158958,1158959,1158960,1159491,1159715,1159847,1159850,1160309,1160438,1160439,1164719,1172091,1172115,1172234,1172236,1172240,1173641,928700,928701
CVE References: CVE-2015-3414,CVE-2015-3415,CVE-2019-19244,CVE-2019-19317,CVE-2019-19603,CVE-2019-19645,CVE-2019-19646,CVE-2019-19880,CVE-2019-19923,CVE-2019-19924,CVE-2019-19925,CVE-2019-19926,CVE-2019-19959,CVE-2019-20218,CVE-2020-13434,CVE-2020-13435,CVE-2020-13630,CVE-2020-13631,CVE-2020-13632,CVE-2020-15358,CVE-2020-9327
JIRA References: SLE-16032
Sources used:
SUSE MicroOS 5.0 (src):    sqlite3-3.36.0-3.12.1
SUSE Manager Server 4.0 (src):    sqlite3-3.36.0-3.12.1
SUSE Manager Retail Branch Server 4.0 (src):    sqlite3-3.36.0-3.12.1
SUSE Manager Proxy 4.0 (src):    sqlite3-3.36.0-3.12.1
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    sqlite3-3.36.0-3.12.1
SUSE Linux Enterprise Server for SAP 15 (src):    sqlite3-3.36.0-3.12.1
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    sqlite3-3.36.0-3.12.1
SUSE Linux Enterprise Server 15-SP1-BCL (src):    sqlite3-3.36.0-3.12.1
SUSE Linux Enterprise Server 15-LTSS (src):    sqlite3-3.36.0-3.12.1
SUSE Linux Enterprise Module for Basesystem 15-SP3 (src):    sqlite3-3.36.0-3.12.1
SUSE Linux Enterprise Module for Basesystem 15-SP2 (src):    sqlite3-3.36.0-3.12.1
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    sqlite3-3.36.0-3.12.1
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    sqlite3-3.36.0-3.12.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    sqlite3-3.36.0-3.12.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    sqlite3-3.36.0-3.12.1
SUSE Enterprise Storage 6 (src):    sqlite3-3.36.0-3.12.1
SUSE CaaS Platform 4.0 (src):    sqlite3-3.36.0-3.12.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 11 Swamp Workflow Management 2021-07-14 20:08:52 UTC

openSUSE-SU-2021:2320-1: An update that fixes 21 vulnerabilities, contains one feature is now available.

Category: security (important)
Bug References: 1157818,1158812,1158958,1158959,1158960,1159491,1159715,1159847,1159850,1160309,1160438,1160439,1164719,1172091,1172115,1172234,1172236,1172240,1173641,928700,928701
CVE References: CVE-2015-3414,CVE-2015-3415,CVE-2019-19244,CVE-2019-19317,CVE-2019-19603,CVE-2019-19645,CVE-2019-19646,CVE-2019-19880,CVE-2019-19923,CVE-2019-19924,CVE-2019-19925,CVE-2019-19926,CVE-2019-19959,CVE-2019-20218,CVE-2020-13434,CVE-2020-13435,CVE-2020-13630,CVE-2020-13631,CVE-2020-13632,CVE-2020-15358,CVE-2020-9327
JIRA References: SLE-16032
Sources used:
openSUSE Leap 15.3 (src):    sqlite3-3.36.0-3.12.1

Comment 12 Wolfgang Frisch 2021-07-15 17:29:02 UTC

(In reply to Reinhard Max from comment #9)
> I guess we can close this based on what you said about SUSE:SLE-12:Update in
> bug 928701 comment 9.

True. Resolved.

Comment 13 Swamp Workflow Management 2021-07-20 01:28:56 UTC

openSUSE-SU-2021:1058-1: An update that fixes 21 vulnerabilities, contains one feature is now available.

Category: security (important)
Bug References: 1157818,1158812,1158958,1158959,1158960,1159491,1159715,1159847,1159850,1160309,1160438,1160439,1164719,1172091,1172115,1172234,1172236,1172240,1173641,928700,928701
CVE References: CVE-2015-3414,CVE-2015-3415,CVE-2019-19244,CVE-2019-19317,CVE-2019-19603,CVE-2019-19645,CVE-2019-19646,CVE-2019-19880,CVE-2019-19923,CVE-2019-19924,CVE-2019-19925,CVE-2019-19926,CVE-2019-19959,CVE-2019-20218,CVE-2020-13434,CVE-2020-13435,CVE-2020-13630,CVE-2020-13631,CVE-2020-13632,CVE-2020-15358,CVE-2020-9327
JIRA References: SLE-16032
Sources used:
openSUSE Leap 15.2 (src):    sqlite3-3.36.0-lp152.4.3.1

Comment 14 Swamp Workflow Management 2021-09-23 20:37:08 UTC

SUSE-SU-2021:3215-1: An update that fixes 28 vulnerabilities, contains one feature is now available.

Category: security (important)
Bug References: 1157818,1158812,1158958,1158959,1158960,1159491,1159715,1159847,1159850,1160309,1160438,1160439,1164719,1172091,1172115,1172234,1172236,1172240,1173641,928700,928701
CVE References: CVE-2015-3414,CVE-2015-3415,CVE-2016-6153,CVE-2017-10989,CVE-2017-2518,CVE-2018-20346,CVE-2018-8740,CVE-2019-16168,CVE-2019-19244,CVE-2019-19317,CVE-2019-19603,CVE-2019-19645,CVE-2019-19646,CVE-2019-19880,CVE-2019-19923,CVE-2019-19924,CVE-2019-19925,CVE-2019-19926,CVE-2019-19959,CVE-2019-20218,CVE-2019-8457,CVE-2020-13434,CVE-2020-13435,CVE-2020-13630,CVE-2020-13631,CVE-2020-13632,CVE-2020-15358,CVE-2020-9327
JIRA References: SLE-16032
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    sqlite3-3.36.0-9.18.1
SUSE OpenStack Cloud Crowbar 8 (src):    sqlite3-3.36.0-9.18.1
SUSE OpenStack Cloud 9 (src):    sqlite3-3.36.0-9.18.1
SUSE OpenStack Cloud 8 (src):    sqlite3-3.36.0-9.18.1
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    sqlite3-3.36.0-9.18.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    sqlite3-3.36.0-9.18.1
SUSE Linux Enterprise Server for SAP 12-SP3 (src):    sqlite3-3.36.0-9.18.1
SUSE Linux Enterprise Server 12-SP5 (src):    sqlite3-3.36.0-9.18.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    sqlite3-3.36.0-9.18.1
SUSE Linux Enterprise Server 12-SP3-LTSS (src):    sqlite3-3.36.0-9.18.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    sqlite3-3.36.0-9.18.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    sqlite3-3.36.0-9.18.1
HPE Helion Openstack 8 (src):    sqlite3-3.36.0-9.18.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.

Comment 15 Marcus Meissner 2021-10-25 13:25:53 UTC

it requires to inject collation sequences, which needs to be programmatic.

then it is only a buffer overread  / crash

no integrity impact, no confidentiality impact as far as i see.

adjusted rating