CVE-2015-3414

sqlite: use of uninitialized memory when parsing collation sequences in src/where.c

Severity Score

7.5

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE clause, as demonstrated by COLLATE"""""""" at the end of a SELECT statement.

SQLite anterior a 3.8.9 no implementa correctamente la descomillación de nombres de secuencias de colaciones, lo que permite a atacantes dependientes de contexto causar una denegación de servicio (acceso a memoria no inicializada y caída de aplicación) o posiblemente tener otro impacto no especificado a través de una clausula COLLATE manipulada, tal y como fue demostrado por COLLATE'''''''' al final de una declaración SELECT.

A flaw was found in the way SQLite handled dequoting of collation-sequence names. A local attacker could submit a specially crafted COLLATE statement that would crash the SQLite process, or have other unspecified impacts.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

Attack Vector

Local

Attack Complexity

High

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2015-04-24 CVE Reserved
2015-04-24 CVE Published
2024-08-06 CVE Updated
2024-10-18 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-456: Missing Initialization of a Variable
CWE-908: Use of Uninitialized Resource

CAPEC

References (17)

URL	Tag	Source
http://seclists.org/fulldisclosure/2015/Apr/31	Mailing List
http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html	Third Party Advisory
http://www.securityfocus.com/bid/74228	Third Party Advisory
http://www.securitytracker.com/id/1033703	Third Party Advisory
https://support.apple.com/HT205213	Third Party Advisory
https://support.apple.com/HT205267	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html	2022-08-16

URL	Date	SRC
http://lists.apple.com/archives/security-announce/2015/Sep/msg00005.html	2022-08-16
http://lists.apple.com/archives/security-announce/2015/Sep/msg00008.html	2022-08-16
http://rhn.redhat.com/errata/RHSA-2015-1635.html	2022-08-16
http://www.debian.org/security/2015/dsa-3252	2022-08-16
http://www.mandriva.com/security/advisories?name=MDVSA-2015:217	2022-08-16
http://www.ubuntu.com/usn/USN-2698-1	2022-08-16
https://security.gentoo.org/glsa/201507-05	2022-08-16
https://www.sqlite.org/src/info/eddc05e7bb31fae74daa86e0504a3478b99fa0f2	2022-08-16
https://access.redhat.com/security/cve/CVE-2015-3414	2015-08-17
https://bugzilla.redhat.com/show_bug.cgi?id=1212353	2015-08-17

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Sqlite Search vendor "Sqlite"		Sqlite Search vendor "Sqlite" for product "Sqlite"				<= 3.8.8.3 Search vendor "Sqlite" for product "Sqlite" and version " <= 3.8.8.3"		-		Affected
Apple Search vendor "Apple"		Mac Os X Search vendor "Apple" for product "Mac Os X"				10.10.5 Search vendor "Apple" for product "Mac Os X" and version "10.10.5"		-		Affected
Apple Search vendor "Apple"		Watchos Search vendor "Apple" for product "Watchos"				1.0.1 Search vendor "Apple" for product "Watchos" and version "1.0.1"		-		Affected
Debian Search vendor "Debian"		Debian Linux Search vendor "Debian" for product "Debian Linux"				8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				12.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "12.04"		lts		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				14.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "14.04"		lts		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				15.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "15.04"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				>= 5.4.0 < 5.4.42 Search vendor "Php" for product "Php" and version " >= 5.4.0 < 5.4.42"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				>= 5.5.0 < 5.5.26 Search vendor "Php" for product "Php" and version " >= 5.5.0 < 5.5.26"		-		Affected
Php Search vendor "Php"		Php Search vendor "Php" for product "Php"				>= 5.6.0 < 5.6.10 Search vendor "Php" for product "Php" and version " >= 5.6.0 < 5.6.10"		-		Affected