Bug 928701 (CVE-2015-3415) - VUL-1: CVE-2015-3415: sqlite3: sqlite3VdbeExec comparison operator vulnerability
Summary: VUL-1: CVE-2015-3415: sqlite3: sqlite3VdbeExec comparison operator vulnerability
Status: RESOLVED FIXED
Alias: CVE-2015-3415
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P4 - Low : Normal
Target Milestone: ---
Deadline: 2016-07-18
Assignee: Security Team bot
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/116276/
Whiteboard: CVSSv3.1:SUSE:CVE-2015-3415:6.7:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2015-04-27 08:38 UTC by Andreas Stieger
Modified: 2022-02-13 10:50 UTC (History)
5 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
upstream patch (1.40 KB, patch)
2019-11-04 15:02 UTC, Wolfgang Frisch 		Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Stieger 2015-04-27 08:38:15 UTC 
The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly
implement comparison operators, which allows context-dependent attackers to
cause a denial of service (invalid free operation) or possibly have unspecified
other impact via a crafted CHECK clause, as demonstrated by CHECK(0&O>O) in a
CREATE TABLE statement.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3415
http://www.cvedetails.com/cve/CVE-2015-3415/
https://www.sqlite.org/src/info/02e3c88fbf6abdcf3975fb0fb71972b0ab30da30
http://www.sqlite.org/releaselog/3_8_9.html

bug CVE-2015-3414, bug CVE-2015-3415 and bug CVE-2015-3416 go together.
Comment 1 Andreas Stieger 2015-04-27 09:34:13 UTC 
bug 928700, bug 928701, bug 928702 all affect the query parser. This is typically exposed to and queries not supplied by users/remotely, except in WebDB / WebSQL like systems mentioned in http://seclists.org/fulldisclosure/2015/Apr/31
Comment 2 Swamp Workflow Management 2015-04-27 22:00:28 UTC 
bugbot adjusting priority
Comment 3 Swamp Workflow Management 2016-07-04 11:18:48 UTC 
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2016-07-18.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/62888
Comment 4 Marcus Meissner 2019-05-29 06:45:54 UTC 
I think we covered most, but back to max for cross checking
Comment 5 Wolfgang Frisch 2019-11-04 15:02:59 UTC 
Created attachment 823269 [details]
upstream patch

Source: https://www.sqlite.org/src/info/02e3c88fbf6abdcf
Comment 10 Reinhard Max 2019-11-18 14:12:10 UTC 
As you said in comment 7 the patched area is quite different in the version on SLE-11 (including SP2). I found a match for the 2nd hunk in the patch, but the area of the 1st hunk looks so different that I couldn't figure out where the additional lines should go or if they are needed at all.
Comment 11 Swamp Workflow Management 2021-07-14 20:04:03 UTC 
SUSE-SU-2021:2320-1: An update that fixes 21 vulnerabilities, contains one feature is now available.

Category: security (important)
Bug References: 1157818,1158812,1158958,1158959,1158960,1159491,1159715,1159847,1159850,1160309,1160438,1160439,1164719,1172091,1172115,1172234,1172236,1172240,1173641,928700,928701
CVE References: CVE-2015-3414,CVE-2015-3415,CVE-2019-19244,CVE-2019-19317,CVE-2019-19603,CVE-2019-19645,CVE-2019-19646,CVE-2019-19880,CVE-2019-19923,CVE-2019-19924,CVE-2019-19925,CVE-2019-19926,CVE-2019-19959,CVE-2019-20218,CVE-2020-13434,CVE-2020-13435,CVE-2020-13630,CVE-2020-13631,CVE-2020-13632,CVE-2020-15358,CVE-2020-9327
JIRA References: SLE-16032
Sources used:
SUSE MicroOS 5.0 (src):    sqlite3-3.36.0-3.12.1
SUSE Manager Server 4.0 (src):    sqlite3-3.36.0-3.12.1
SUSE Manager Retail Branch Server 4.0 (src):    sqlite3-3.36.0-3.12.1
SUSE Manager Proxy 4.0 (src):    sqlite3-3.36.0-3.12.1
SUSE Linux Enterprise Server for SAP 15-SP1 (src):    sqlite3-3.36.0-3.12.1
SUSE Linux Enterprise Server for SAP 15 (src):    sqlite3-3.36.0-3.12.1
SUSE Linux Enterprise Server 15-SP1-LTSS (src):    sqlite3-3.36.0-3.12.1
SUSE Linux Enterprise Server 15-SP1-BCL (src):    sqlite3-3.36.0-3.12.1
SUSE Linux Enterprise Server 15-LTSS (src):    sqlite3-3.36.0-3.12.1
SUSE Linux Enterprise Module for Basesystem 15-SP3 (src):    sqlite3-3.36.0-3.12.1
SUSE Linux Enterprise Module for Basesystem 15-SP2 (src):    sqlite3-3.36.0-3.12.1
SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src):    sqlite3-3.36.0-3.12.1
SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src):    sqlite3-3.36.0-3.12.1
SUSE Linux Enterprise High Performance Computing 15-LTSS (src):    sqlite3-3.36.0-3.12.1
SUSE Linux Enterprise High Performance Computing 15-ESPOS (src):    sqlite3-3.36.0-3.12.1
SUSE Enterprise Storage 6 (src):    sqlite3-3.36.0-3.12.1
SUSE CaaS Platform 4.0 (src):    sqlite3-3.36.0-3.12.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 12 Swamp Workflow Management 2021-07-14 20:08:59 UTC 
openSUSE-SU-2021:2320-1: An update that fixes 21 vulnerabilities, contains one feature is now available.

Category: security (important)
Bug References: 1157818,1158812,1158958,1158959,1158960,1159491,1159715,1159847,1159850,1160309,1160438,1160439,1164719,1172091,1172115,1172234,1172236,1172240,1173641,928700,928701
CVE References: CVE-2015-3414,CVE-2015-3415,CVE-2019-19244,CVE-2019-19317,CVE-2019-19603,CVE-2019-19645,CVE-2019-19646,CVE-2019-19880,CVE-2019-19923,CVE-2019-19924,CVE-2019-19925,CVE-2019-19926,CVE-2019-19959,CVE-2019-20218,CVE-2020-13434,CVE-2020-13435,CVE-2020-13630,CVE-2020-13631,CVE-2020-13632,CVE-2020-15358,CVE-2020-9327
JIRA References: SLE-16032
Sources used:
openSUSE Leap 15.3 (src):    sqlite3-3.36.0-3.12.1
Comment 13 Wolfgang Frisch 2021-07-15 17:31:39 UTC 
Resolved.
Comment 14 Swamp Workflow Management 2021-07-20 01:29:02 UTC 
openSUSE-SU-2021:1058-1: An update that fixes 21 vulnerabilities, contains one feature is now available.

Category: security (important)
Bug References: 1157818,1158812,1158958,1158959,1158960,1159491,1159715,1159847,1159850,1160309,1160438,1160439,1164719,1172091,1172115,1172234,1172236,1172240,1173641,928700,928701
CVE References: CVE-2015-3414,CVE-2015-3415,CVE-2019-19244,CVE-2019-19317,CVE-2019-19603,CVE-2019-19645,CVE-2019-19646,CVE-2019-19880,CVE-2019-19923,CVE-2019-19924,CVE-2019-19925,CVE-2019-19926,CVE-2019-19959,CVE-2019-20218,CVE-2020-13434,CVE-2020-13435,CVE-2020-13630,CVE-2020-13631,CVE-2020-13632,CVE-2020-15358,CVE-2020-9327
JIRA References: SLE-16032
Sources used:
openSUSE Leap 15.2 (src):    sqlite3-3.36.0-lp152.4.3.1
Comment 15 Swamp Workflow Management 2021-09-23 20:37:15 UTC 
SUSE-SU-2021:3215-1: An update that fixes 28 vulnerabilities, contains one feature is now available.

Category: security (important)
Bug References: 1157818,1158812,1158958,1158959,1158960,1159491,1159715,1159847,1159850,1160309,1160438,1160439,1164719,1172091,1172115,1172234,1172236,1172240,1173641,928700,928701
CVE References: CVE-2015-3414,CVE-2015-3415,CVE-2016-6153,CVE-2017-10989,CVE-2017-2518,CVE-2018-20346,CVE-2018-8740,CVE-2019-16168,CVE-2019-19244,CVE-2019-19317,CVE-2019-19603,CVE-2019-19645,CVE-2019-19646,CVE-2019-19880,CVE-2019-19923,CVE-2019-19924,CVE-2019-19925,CVE-2019-19926,CVE-2019-19959,CVE-2019-20218,CVE-2019-8457,CVE-2020-13434,CVE-2020-13435,CVE-2020-13630,CVE-2020-13631,CVE-2020-13632,CVE-2020-15358,CVE-2020-9327
JIRA References: SLE-16032
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    sqlite3-3.36.0-9.18.1
SUSE OpenStack Cloud Crowbar 8 (src):    sqlite3-3.36.0-9.18.1
SUSE OpenStack Cloud 9 (src):    sqlite3-3.36.0-9.18.1
SUSE OpenStack Cloud 8 (src):    sqlite3-3.36.0-9.18.1
SUSE Linux Enterprise Software Development Kit 12-SP5 (src):    sqlite3-3.36.0-9.18.1
SUSE Linux Enterprise Server for SAP 12-SP4 (src):    sqlite3-3.36.0-9.18.1
SUSE Linux Enterprise Server for SAP 12-SP3 (src):    sqlite3-3.36.0-9.18.1
SUSE Linux Enterprise Server 12-SP5 (src):    sqlite3-3.36.0-9.18.1
SUSE Linux Enterprise Server 12-SP4-LTSS (src):    sqlite3-3.36.0-9.18.1
SUSE Linux Enterprise Server 12-SP3-LTSS (src):    sqlite3-3.36.0-9.18.1
SUSE Linux Enterprise Server 12-SP3-BCL (src):    sqlite3-3.36.0-9.18.1
SUSE Linux Enterprise Server 12-SP2-BCL (src):    sqlite3-3.36.0-9.18.1
HPE Helion Openstack 8 (src):    sqlite3-3.36.0-9.18.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.