Bug 928702 (CVE-2015-3416) - VUL-1: CVE-2015-3416: sqlite3,sqlite2: sqlite3VXPrintf precision and width handling vulnerability
Summary: VUL-1: CVE-2015-3416: sqlite3,sqlite2: sqlite3VXPrintf precision and width ha...
Status: RESOLVED WONTFIX
Alias: CVE-2015-3416
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P4 - Low : Normal
Target Milestone: ---
Deadline: 2016-07-18
Assignee: Reinhard Max
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/116277/
Whiteboard: CVSSv3.1:SUSE:CVE-2015-3416:6.7:(AV:...
Keywords:
Depends on:
Blocks:
 
Reported: 2015-04-27 08:38 UTC by Andreas Stieger
Modified: 2021-10-28 07:56 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
upstream patch (1.89 KB, patch)
2019-11-04 15:39 UTC, Wolfgang Frisch
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Stieger 2015-04-27 08:38:17 UTC
The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not
properly handle precision and width values during floating-point conversions,
which allows context-dependent attackers to cause a denial of service (integer
overflow and stack-based buffer overflow) or possibly have unspecified other
impact via large integers in a crafted printf function call in a SELECT
statement.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3416
http://www.cvedetails.com/cve/CVE-2015-3416/
http://www.sqlite.org/src/info/c494171f77dc2e5e04cb6d865e688448f04e5920
http://www.sqlite.org/releaselog/3_8_9.html

bug CVE-2015-3414, bug CVE-2015-3415 and bug CVE-2015-3416 go together.
Comment 1 Andreas Stieger 2015-04-27 09:34:12 UTC
bug 928700, bug 928701, bug 928702 all affect the query parser. This is typically exposed to and queries not supplied by users/remotely, except in WebDB / WebSQL like systems mentioned in http://seclists.org/fulldisclosure/2015/Apr/31
Comment 2 Swamp Workflow Management 2015-04-27 22:00:38 UTC
bugbot adjusting priority
Comment 3 Swamp Workflow Management 2016-07-04 11:19:10 UTC
An update workflow for this issue was started.
This issue was rated as moderate.
Please submit fixed packages until 2016-07-18.
When done, reassign the bug to security-team@suse.de.
https://swamp.suse.de/webswamp/wf/62888
Comment 4 Marcus Meissner 2019-05-29 06:46:53 UTC
back to max for cross verification if we fixed this
Comment 5 Wolfgang Frisch 2019-11-04 15:39:38 UTC
Created attachment 823274 [details]
upstream patch

Source: https://www.sqlite.org/src/info/c494171f77dc2e5e
Comment 9 Marcus Meissner 2021-10-27 09:59:36 UTC
sles11 sp2 sqlite3 is not affected, as the precision is bound to the stack buffer size

        if( precision>etBUFSIZE/2-10 ) precision = etBUFSIZE/2-10;

while in later versions it no longer is (sqlite transitions to a malloced buffer).

The security bug was the transition to the malloced buffer was not handled in integer overflow cases between precision + width.