Chiwopsezo mu SQLite chomwe chimalola kuwukira kutali pa Chrome kudzera pa WebSQL

Ofufuza zachitetezo kuchokera ku kampani yaku China Tencent zoperekedwa kusatetezeka kwatsopano Magellan (CVE-2019-13734), zomwe zimakupatsani mwayi wokwaniritsa ma code mukamakonza ma SQL opangidwa mwanjira inayake mu SQLite DBMS. Panali kusatetezeka kofananako losindikizidwa ndi ofufuza omwewo chaka chapitacho. Chiwopsezochi ndi chodziwikiratu chifukwa chimalola munthu kuukira msakatuli wa Chrome ali patali ndikuwongolera dongosolo la wogwiritsa ntchito akamatsegula masamba oyendetsedwa ndi wowukira.

Kuwukira kwa Chrome/Chromium kumachitika kudzera pa WebSQL API, yemwe amagwira ntchito yake yochokera pa SQLite code. Kuwukira kwa mapulogalamu ena kumatheka kokha ngati alola kusamutsidwa kwa SQL yomanga kuchokera kunja kupita ku SQLite, mwachitsanzo, amagwiritsa ntchito SQLite ngati mawonekedwe osinthira deta. Firefox siili pachiwopsezo chifukwa Mozilla anakana kuchokera pakukhazikitsa kwa WebSQL phindu IndexedDB API.

Google yathetsa vutoli posachedwa Chrome 79. Panali vuto mu SQLite codebase okhazikika Novembala 17, komanso mu Chromium codebase - 21 gawo.
Vuto lilipo mu kachidindo Injini yofufuzira ya mawu athunthu a FTS3 komanso kugwiritsa ntchito matebulo amithunzi (mtundu wapadera wa tebulo lokhala ndi mawu olembedwa) atha kubweretsa katangale komanso kusefukira kwa buffer. Zambiri zamakina ogwiritsira ntchito zidzasindikizidwa pakadutsa masiku 90.

Kutulutsidwa kwatsopano kwa SQLite kokonzekera pano osapangidwa (akuyembekezeka kutero Disembala 31). Monga njira yoyendetsera chitetezo, kuyambira ndi SQLite 3.26.0, SQLite_DBCONFIG_DEFENSIVE mode ingagwiritsidwe ntchito, yomwe imalepheretsa kulembera kumatebulo azithunzi ndipo imalimbikitsidwa kuti ikhalepo pokonza mafunso akunja a SQL mu SQLite. M'magawo ogawa, chiwopsezo cha laibulale ya SQLite sichinakhazikike Debian, Ubuntu, RHEL, kutsegulaSUSE / SUSE, Arch Linux, Fedora, FreeBSD. Chromium m'magawo onse adasinthidwa kale ndipo sanakhudzidwe ndi chiopsezo, koma vuto likhoza kukhudza asakatuli ndi mapulogalamu ena omwe amagwiritsa ntchito injini ya Chromium, komanso mapulogalamu a Android kutengera Webview.

Kuphatikiza apo, mavuto 4 owopsa kwambiri adadziwikanso mu SQLite (CVE-2019-13750, CVE-2019-13751, CVE-2019-13752, CVE-2019-13753), zomwe zingayambitse kutayikira kwa chidziwitso ndi kutsekereza zoletsa (zingagwiritsidwe ntchito ngati zinthu zomwe zimathandizira pakuwukira kwa Chrome). Nkhanizi zidakhazikitsidwa mu code ya SQLite pa Disembala 13th. Kuphatikizidwa pamodzi, mavutowa adalola ochita kafukufuku kukonzekera ntchito yomwe imalola kuti code ichitidwe mogwirizana ndi ndondomeko ya Chromium yomwe imayang'anira kupereka.

Source: opennet.ru