Security researchers from the Chinese company Tencent a new variant of the vulnerability (), allowing code execution when handling SQL constructs formatted in a certain way in the SQLite DBMS. A similar vulnerability was identified by the same researchers a year ago. The vulnerability is notable for allowing remote attacks on the Chrome browser, enabling the attacker to gain control over the user's system when opening web pages controlled by the attacker.
The attack on Chrome/Chromium is executed via the WebSQL API, the handler for which is based on SQLite code. Attacks on other applications are possible only if they permit the transfer of SQL constructs from external sources to SQLite, for example, if they use SQLite as a data exchange format. Firefox is not vulnerable, as Mozilla has not implemented WebSQL in the IndexedDB API.
Google fixed the issue in the release . The problem in the SQLite codebase was on November 17, while in the Chromium codebase - .
The problem exists in the full-text search engine FTS3 and may lead to index corruption and buffer overflow through manipulation of shadow tables (a special kind of virtual tables with write capability). Detailed information about the exploitation technique will be published in 90 days.
The new SQLite release with the fix has not yet ( by December 31). As a workaround for protection, starting from SQLite 3.26.0, the SQLITE_DBCONFIG_DEFENSIVE mode can be used, which prohibits writing to shadow tables and is recommended for use when processing external SQL queries in SQLite. The vulnerability in the SQLite library remains unpatched in , , , , , , . Chromium has already been updated in all distributions and is not vulnerable, but the problem may affect various third-party browsers and applications that use the Chromium engine, as well as Android applications based on Webview.
Additionally, 4 less severe issues have also been identified in SQLite (, , , ), which could lead to information leaks and circumventing restrictions (could be used as contributing factors for an attack on Chrome). The identified issues were addressed in the SQLite code on December 13th. Collectively, the problems allowed researchers to prepare a working exploit that could execute code within the context of the Chromium process responsible for rendering.
Source: opennet.ru
