Bug 936835 (CVE-2015-3659) - VUL-0: CVE-2015-3659: sqlite3,sqlite2: SQLite Default Value Authorization Bypass Vulnerability
Summary: VUL-0: CVE-2015-3659: sqlite3,sqlite2: SQLite Default Value Authorization Byp...
Status: RESOLVED INVALID
Alias: CVE-2015-3659
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P3 - Medium : Major
Target Milestone: ---
Assignee: Reinhard Max
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/118263/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-07-02 08:39 UTC by Andreas Stieger
Modified: 2015-07-27 10:57 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Stieger 2015-07-02 08:39:40 UTC
via ZDI:

This vulnerability allows remote attackers to execute arbitrary code on
vulnerable installations of SQLite. User interaction is required to exploit this
vulnerability in that the target must visit a malicious page or open a malicious
file.

The specific flaw exists within the handling of DEFAULT expressions for column
values.  The issue lies in the ability to create a table that will execute
privileged functions by specifying a DEFAULT value for a column and then
inserting into the table.  An attacker can leverage this vulnerability to
execute restricted SQL statements under the context of the current process.



I found zero reference on this on the sqlite upstream project?
And why does it link to Apple for an update?

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3659
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3659
http://www.zerodayinitiative.com/advisories/ZDI-15-291/
Comment 1 Andreas Stieger 2015-07-02 08:44:51 UTC
https://support.apple.com/de-de/HT204950

> WebKit Storage
> 
> Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5, and OS X
> Yosemite v10.10.3
> 
> Impact: Visiting a maliciously crafted webpage may lead to an unexpected 
> application termination or arbitrary code execution
> 
> Description: An insufficient comparison issue existed in SQLite authorizer
> which allowed invocation of arbitrary SQL functions. This issue was addressed 
> with improved authorization checks.
> 
> CVE-2015-3659 : Peter Rutenbar working with HP's Zero Day Initiative


Is SQLite authorizer specific to the OS X platform, or do we ship this in this or a similar form?
Comment 2 Reinhard Max 2015-07-02 10:11:03 UTC
The SQLite authorizer is generic. It is a callback mechanism for allowing or denying the execution of SQL code from untrusted sources:

https://www.sqlite.org/c3ref/set_authorizer.html

But it looks to me like the problem was in the callbacks that OSX uses with the authorizer rather than in the authorizer code itself, because upstream hasn't touched the respective source file since 2009.

I will cross-check this with the author.
Comment 3 Swamp Workflow Management 2015-07-02 22:00:26 UTC
bugbot adjusting priority
Comment 4 Andreas Stieger 2015-07-17 10:59:13 UTC
(In reply to Reinhard Max from comment #2)
> The SQLite authorizer is generic. It is a callback mechanism for allowing or
> denying the execution of SQL code from untrusted sources:
> 
> https://www.sqlite.org/c3ref/set_authorizer.html
> 
> But it looks to me like the problem was in the callbacks that OSX uses with
> the authorizer rather than in the authorizer code itself, because upstream
> hasn't touched the respective source file since 2009.
> 
> I will cross-check this with the author.

Did you get anything?
Comment 7 Reinhard Max 2015-07-27 10:23:33 UTC
Here's the conversation from today:

--- snip ---

> as the maintainer of the SQLite RPMs on SUSE, I am currently faced
> with a bug report concerning CVE-2015-3659[0].
>
> From the CVE's description it looks to me like the bug was in Apple's
> authorizer callback rather than SQLite's authorization mechanism, can
> anyone confirm this?

Your email was the first time we (the SQLite developers) have heard of
this issue.  We have no additional information.

It sounds, as you say, like Apple's callback was misimplemented and
that this is not a fault within SQLite.

--- snap ---
Comment 8 Andreas Stieger 2015-07-27 10:57:31 UTC
Thanks, rejecting as not affecting the GNU/Linux platform.