openSUSE-SU-2016:2041

[oss-security] 20160701 SQLite Tempdir Selection Vulnerability

[oss-security] 20160701 Re: SQLite Tempdir Selection Vulnerability

91546

http://www.sqlite.org/cgi/src/info/67985761aa93fb61

FEDORA-2016-0138339b54

FEDORA-2019-49f80a78bc

USN-4019-1

USN-4019-2

https://www.korelogic.com/Resources/Advisories/KL-001-2016-003.txt

https://www.sqlite.org/releaselog/3_13_0.html

https://www.tenable.com/security/tns-2016-20

It was discovered that SQLite incorrectly handled certain SQL files.
An attacker could possibly use this issue to execute arbitrary code or cause a denial of service. This issue only affected Ubuntu 16.04 LTS.
(CVE-2017-2518, CVE-2017-2520)

It was discovered that SQLite incorrectly handled certain queries. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 18.10.
(CVE-2018-20505)

It was discovered that SQLite incorrectly handled certain queries. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-20346, CVE-2018-20506)

It was discovered that SQLite incorrectly handled certain inputs. An attacker could possibly use this issue to access sensitive information. (CVE-2019-8457)

It was discovered that SQLite incorrectly handled certain queries. An attacker could possibly use this issue to access sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2019-9936)

It was discovered that SQLite incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2019-9937)

It was discovered that SQLite incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 16.04 LTS. (CVE-2016-6153)

It was discovered that SQLite incorrectly handled certain databases.
An attacker could possibly use this issue to access sensitive information. This issue only affected Ubuntu 16.04 LTS.
(CVE-2017-10989)

It was discovered that SQLite incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 16.04 LTS. (CVE-2017-13685)

It was discovered that SQLite incorrectly handled certain queries. An attacker could possibly use this issue to execute arbitrary code or cause a denial of service. This issue only affected Ubuntu 16.04 LTS.
(CVE-2017-2519).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sqlite3 fixes the following issues :

Security issues fixed :

CVE-2018-20506: Fixed an integer overflow when FTS3 extension is enabled (bsc#1131576).

CVE-2018-20346: Fixed a remote code execution vulnerability in FTS3 (Magellan) (bsc#1119687).

CVE-2016-6153: Fixed incorrect permissions when creating temporary files (bsc#987394).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the sqlite packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - os_unix.c in SQLite before 3.13.0 improperly implements     the temporary directory search algorithm, which might     allow local users to obtain sensitive information,     cause a denial of service (application crash), or have     unspecified other impact by leveraging use of the     current working directory for temporary     files.(CVE-2016-6153)

  - The getNodeSize function in ext/rtree/rtree.c in SQLite     through 3.19.3, as used in GDAL and other products,     mishandles undersized RTree blobs in a crafted     database, leading to a heap-based buffer over-read or     possibly unspecified other impact.(CVE-2017-10989)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of Apple iTunes installed on the remote macOS or Mac OS X host is prior to 12.6. It is, therefore, affected by multiple vulnerabilities :

  - Multiple vulnerabilities exist in the expat component,     the most severe of which are remote code execution     vulnerabilities. An unauthenticated, remote attacker can     exploit these vulnerabilities to cause a denial of     service condition or the execution of arbitrary code in     the context of the current user. (CVE-2009-3270,     CVE-2009-3560, CVE-2009-3720, CVE-2012-1147,     CVE-2012-1148, CVE-2012-6702, CVE-2015-1283,     CVE-2016-0718, CVE-2016-4472, CVE-2016-5300)

  - Multiple vulnerabilities exist in the SQLite component,     the most severe of which are remote code execution     vulnerabilities. An unauthenticated, remote attacker can     exploit these vulnerabilities by convincing a user to     open a specially crafted file, to cause a denial of     service condition or the execution of arbitrary code in     the context of the current user. (CVE-2013-7443,     CVE-2015-3414, CVE-2015-3415, CVE-2015-3416,     CVE-2015-3717, CVE-2015-6607, CVE-2016-6153)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apple iTunes running on the remote host is prior to 12.6. It is, therefore, affected by multiple vulnerabilities :

  - Multiple vulnerabilities exist in the expat component,     the most severe of which are remote code execution     vulnerabilities. An unauthenticated, remote attacker can     exploit these vulnerabilities to cause a denial of     service condition or the execution of arbitrary code in     the context of the current user. (CVE-2009-3270,     CVE-2009-3560, CVE-2009-3720, CVE-2012-1147,     CVE-2012-1148, CVE-2012-6702, CVE-2015-1283,     CVE-2016-0718, CVE-2016-4472, CVE-2016-5300)

  - Multiple vulnerabilities exist in the SQLite component,     the most severe of which are remote code execution     vulnerabilities. An unauthenticated, remote attacker can     exploit these vulnerabilities by convincing a user to     open a specially crafted file, to cause a denial of     service condition or the execution of arbitrary code in     the context of the current user. (CVE-2013-7443,     CVE-2015-3414, CVE-2015-3415, CVE-2015-3416,     CVE-2015-3717, CVE-2015-6607, CVE-2016-6153)

  - An information disclosure vulnerability exists in the     APNs server component due to client certificates being     transmitted in cleartext. A man-in-the-middle attacker     can exploit this to disclose sensitive information.
    (CVE-2017-2383)

  - A use-after-free error exists in the WebKit component     due to improper handling of RenderBox objects. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-2463)

  - Multiple universal cross-site scripting (XSS)     vulnerabilities exist in the WebKit component due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these     vulnerabilities, by convincing a user to visit a     specially crafted web page, to execute arbitrary script     code in a user's browser session. (CVE-2017-2479,     CVE-2017-2480, CVE-2017-2493)

  - An integer overflow condition exists in the libxslt     component in the xsltAddTextString() function in     transform.c due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this to cause an out-of-bounds write, resulting in the     execution of arbitrary code. (CVE-2017-5029)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apple iTunes installed on the remote Windows host is prior to 12.6. It is, therefore, affected by multiple vulnerabilities :

  - Multiple vulnerabilities exist in the expat component,     the most severe of which are remote code execution     vulnerabilities. An unauthenticated, remote attacker can     exploit these vulnerabilities to cause a denial of     service condition or the execution of arbitrary code in     the context of the current user. (CVE-2009-3270,     CVE-2009-3560, CVE-2009-3720, CVE-2012-1147,     CVE-2012-1148, CVE-2012-6702, CVE-2015-1283,     CVE-2016-0718, CVE-2016-4472, CVE-2016-5300)

  - Multiple vulnerabilities exist in the SQLite component,     the most severe of which are remote code execution     vulnerabilities. An unauthenticated, remote attacker can     exploit these vulnerabilities by convincing a user to     open a specially crafted file, to cause a denial of     service condition or the execution of arbitrary code in     the context of the current user. (CVE-2013-7443,     CVE-2015-3414, CVE-2015-3415, CVE-2015-3416,     CVE-2015-3717, CVE-2015-6607, CVE-2016-6153)

  - An information disclosure vulnerability exists in the     APNs server component due to client certificates being     transmitted in cleartext. A man-in-the-middle attacker     can exploit this to disclose sensitive information.
    (CVE-2017-2383)

  - A use-after-free error exists in the WebKit component     due to improper handling of RenderBox objects. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-2463)

  - Multiple universal cross-site scripting (XSS)     vulnerabilities exist in the WebKit component due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these     vulnerabilities, by convincing a user to visit a     specially crafted web page, to execute arbitrary script     code in a user's browser session. (CVE-2017-2479,     CVE-2017-2480, CVE-2017-2493)

  - An integer overflow condition exists in the libxslt     component in the xsltAddTextString() function in     transform.c due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this to cause an out-of-bounds write, resulting in the     execution of arbitrary code. (CVE-2017-5029)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tenable Passive Vulnerability Scanner (PVS) installed on the remote host is 5.x < 5.2.0. It is, therefore, affected by multiple vulnerabilities :

  - Multiple denial of service vulnerabilities exist in     Expat within file xmlparse.c due to a logical error in     hash computations. An unauthenticated, remote attacker     can exploit these, via a specially crafted XML file     containing many identifiers with the same value, to     cause the service to exhaust CPU resources.
    (CVE-2012-0876, CVE-2016-5300)

  - A flaw exists in the generate_hash_secret_salt()     function in file lib/xmlparse.c within Expat due to the     generation of non-random output by the PRNG. An     unauthenticated, remote attacker can exploit this to     more easily predict the PRNG output. (CVE-2012-6702)

  - Multiple buffer overflow conditions exist within Expat,     specifically in the XML_GetBuffer() function in file     lib/xmlparse.c, due to improper validation of     user-supplied input when handling compressed XML     content. An unauthenticated, remote attacker can exploit     these to execute arbitrary code. (CVE-2015-1283,     CVE-2016-4472)

  - Multiple buffer overflow conditions exist within the     Expat XML parser when handling malformed input documents     due to improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2016-0718, CVE-2016-0719)

  - Multiple integer overflow conditions exist in s3_srvr.c,     ssl_sess.c, and t1_lib.c due to improper use of pointer     arithmetic for heap-buffer boundary checks. An     unauthenticated, remote attacker can exploit these to     cause a denial of service. (CVE-2016-2177)

  - An information disclosure vulnerability exists in the     dsa_sign_setup() function in dsa_ossl.c due to a failure     to properly ensure the use of constant-time operations.
    An unauthenticated, remote attacker can exploit this,     via a timing side-channel attack, to disclose DSA key     information. (CVE-2016-2178)

  - A denial of service vulnerability exists in the DTLS     implementation due to a failure to properly restrict the     lifetime of queue entries associated with unused     out-of-order messages. An unauthenticated, remote     attacker can exploit this, by maintaining multiple     crafted DTLS sessions simultaneously, to exhaust memory.
    (CVE-2016-2179)

  - An out-of-bounds read error exists in the X.509 Public     Key Infrastructure Time-Stamp Protocol (TSP)     implementation. An unauthenticated, remote attacker can     exploit this, via a crafted time-stamp file that is     mishandled by the 'openssl ts' command, to cause     denial of service or to disclose sensitive information.
    (CVE-2016-2180)

  - A denial of service vulnerability exists in the     Anti-Replay feature in the DTLS implementation due to     improper handling of epoch sequence numbers in records.
    An unauthenticated, remote attacker can exploit this,     via spoofed DTLS records, to cause legitimate packets to     be dropped. (CVE-2016-2181)

  - An overflow condition exists in the BN_bn2dec() function     in bn_print.c due to improper validation of     user-supplied input when handling BIGNUM values. An     unauthenticated, remote attacker can exploit this to     crash the process. (CVE-2016-2182)

  - A vulnerability exists, known as SWEET32, in the 3DES     and Blowfish algorithms due to the use of weak 64-bit     block ciphers by default. A man-in-the-middle attacker     who has sufficient resources can exploit this     vulnerability, via a 'birthday' attack, to detect a     collision that leaks the XOR between the fixed secret     and a known plaintext, allowing the disclosure of the     secret text, such as secure HTTPS cookies, and possibly     resulting in the hijacking of an authenticated session.
    (CVE-2016-2183)

  - A flaw exists in SQLite due to the use of insecure     temporary directories. A local attacker can exploit this     to cause a denial of service condition or possibly have     other more severe impact. (CVE-2016-6153)

  - A flaw exists in the tls_decrypt_ticket() function in     t1_lib.c due to improper handling of ticket HMAC     digests. An unauthenticated, remote attacker can exploit     this, via a ticket that is too short, to crash the     process, resulting in a denial of service.
    (CVE-2016-6302)

  - An integer overflow condition exists in the     MDC2_Update() function in mdc2dgst.c due to improper     validation of user-supplied input. An unauthenticated,     remote attacker can exploit this to cause a heap-based     buffer overflow, resulting in a denial of service     condition or possibly the execution of arbitrary code.
    (CVE-2016-6303)

  - A flaw exists in the ssl_parse_clienthello_tlsext()     function in t1_lib.c due to improper handling of overly     large OCSP Status Request extensions from clients. An     unauthenticated, remote attacker can exploit this, via     large OCSP Status Request extensions, to exhaust memory     resources, resulting in a denial of service condition.
    (CVE-2016-6304)

  - A flaw exists in the SSL_peek() function in     rec_layer_s3.c due to improper handling of empty     records. An unauthenticated, remote attacker can exploit     this, by triggering a zero-length record in an SSL_peek     call, to cause an infinite loop, resulting in a denial     of service condition. (CVE-2016-6305)

  - An out-of-bounds read error exists in the certificate     parser that allows an unauthenticated, remote attacker     to cause a denial of service via crafted certificate     operations. (CVE-2016-6306)

  - A denial of service vulnerability exists in the     state-machine implementation due to a failure to check     for an excessive length before allocating memory. An     unauthenticated, remote attacker can exploit this, via a     crafted TLS message, to exhaust memory resources.
    (CVE-2016-6307)

  - A denial of service vulnerability exists in the DTLS     implementation due to improper handling of excessively     long DTLS messages. An unauthenticated, remote attacker     can exploit this, via a crafted DTLS message, to exhaust     available memory resources. (CVE-2016-6308)

  - A remote code execution vulnerability exists in the     read_state_machine() function in statem.c due to     improper handling of messages larger than 16k. An     unauthenticated, remote attacker can exploit this, via a     specially crafted message, to cause a use-after-free     error, resulting in a denial of service condition or     possibly the execution of arbitrary code.
    (CVE-2016-6309)

  - A cross-site scripting (XSS) vulnerability exists within     the JQuery UI dialog() function due to improper     validation of input to the 'closeText' parameter before     returning it to users. An unauthenticated, remote     attacker can exploit this, via a specially crafted     request, to execute arbitrary script code in a user's     browser session. (CVE-2016-7103)

  - A denial of service vulnerability exists in x509_vfy.c     due to improper handling of certificate revocation lists     (CRLs). An unauthenticated, remote attacker can exploit     this, via a specially crafted CRL, to cause a NULL     pointer dereference, resulting in a crash of the     service. (CVE-2016-7052)

  - An unspecified cross-site scripting (XSS) vulnerability     exists in the web interface due to improper validation     of input before returning it to users. An     unauthenticated, remote attacker can exploit this, via a     specially crafted request, to execute arbitrary script     code in a user's browser session.

This update for sqlite3 fixes the following issues: The following security issue was fixed :

  - CVE-2016-6153: Fixed a tempdir selection vulnerability     (bsc#987394)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for sqlite3 fixes the following issues :

The following security issue was fixed :

  - CVE-2016-6153: Fixed a tempdir selection vulnerability     (bsc#987394)

This update was imported from the SUSE:SLE-12-SP1:Update update project.

This update for sqlite3 fixes the following issues :

  - CVE-2016-6153: Tempdir Selection Vulnerability could     have led to data leakage under very specific,     non-default circumstances (boo#987394)

Security fix for CVE-2016-6153

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that sqlite3, a C library that implements a SQL database engine, would reject a temporary directory (e.g., as specified by the TMPDIR environment variable) to which the executing user did not have read permissions. This could result in information leakage as less secure global temporary directories (e.g., /var/tmp or /tmp) would be used instead.

For Debian 7 'Wheezy', this problem has been fixed in version 3.7.13-1+deb7u3.

We recommend that you upgrade your sqlite3 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

KoreLogic security reports :

Affected versions of SQLite reject potential tempdir locations if they are not readable, falling back to '.'. Thus, SQLite will favor e.g.
using cwd for tempfiles on such a system, even if cwd is an unsafe location. Notably, SQLite also checks the permissions of '.', but ignores the results of that check.

ID	Name	Product	Family	Severity
126065	Ubuntu 16.04 LTS / 18.04 LTS / 18.10 / 19.04 : sqlite3 vulnerabilities (USN-4019-1)	Nessus	Ubuntu Local Security Checks	high
124150	SUSE SLES12 Security Update : sqlite3 (SUSE-SU-2019:0973-1)	Nessus	SuSE Local Security Checks	medium
123743	EulerOS Virtualization 2.5.3 : sqlite (EulerOS-SA-2019-1275)	Nessus	Huawei Local Security Checks	high
100027	Apple iTunes < 12.6 Multiple Vulnerabilities (macOS) (credentialed check)	Nessus	MacOS X Local Security Checks	high
100026	Apple iTunes < 12.6 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	high
100025	Apple iTunes < 12.6 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	high
96337	Tenable Passive Vulnerability Scanner 5.x < 5.2.0 Multiple Vulnerabilities (SWEET32)	Nessus	Misc.	critical
93285	SUSE SLES11 Security Update : sqlite3 (SUSE-SU-2016:2021-1)	Nessus	SuSE Local Security Checks	medium
93189	SUSE SLED12 / SLES12 Security Update : sqlite3 (SUSE-SU-2016:1945-1)	Nessus	SuSE Local Security Checks	medium
92976	openSUSE Security Update : sqlite3 (openSUSE-2016-970)	Nessus	SuSE Local Security Checks	medium
92744	openSUSE Security Update : sqlite3 (openSUSE-2016-931)	Nessus	SuSE Local Security Checks	medium
92225	Fedora 24 : sqlite (2016-0138339b54)	Nessus	Fedora Local Security Checks	medium
91948	Debian DLA-543-1 : sqlite3 security update	Nessus	Debian Local Security Checks	medium
91929	FreeBSD : SQLite3 -- Tempdir Selection Vulnerability (546deeea-3fc6-11e6-a671-60a44ce6887b)	Nessus	FreeBSD Local Security Checks	medium

CVE-2016-6153

Description

References

Details

Risk Information

CVSS v2.0

CVSS v3.0

Vulnerable Software

Configuration 1

Configuration 2

Configuration 3

Tenable Plugins