Integer Overflow and Buffer Overflow in SQLite FTS3 Extension
Summary
CVE-2018-20346: SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers... Affects sqlite across 2 version ranges.
< 3.25.3-r0
< ea6eb55ebe6d6e427f3dc908ecc7ced8529adf10
Fixed in 3.25.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
SQLite is a popular open-source relational database management system that is widely used in various applications. It provides a lightweight and self-contained database engine, making it a preferred choice for embedded systems and mobile applications. The FTS3 extension in SQLite enables full-text search capabilities. However, prior to version 3.25.3, SQLite is vulnerable to an integer overflow and resultant buffer overflow when the FTS3 extension is enabled.
Vulnerability Detail
The vulnerability, known as CVE-2018-20346 or Magellan, occurs when crafted changes are made to FTS3 shadow tables in SQLite. This can lead to an integer overflow, which in turn triggers a buffer overflow. Remote attackers can exploit this vulnerability by running arbitrary SQL statements, such as in certain WebSQL use cases. By leveraging this ability, attackers can execute arbitrary code on the target system. The severity of this vulnerability is rated as critical with a CVSSv3 score of 8.1.
How To Fix
Minimum fixed version
3.25.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade sqliteTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official fix by upgrading to a patched version of SQLite.
Conclusion
The integer overflow and buffer overflow vulnerability in SQLite's FTS3 extension can be exploited by remote attackers to execute arbitrary code on affected systems. To mitigate this risk, it is recommended to upgrade SQLite to version 3.25.3 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sqlite →
FAQ
SQLite is an open-source relational database management system that provides a lightweight and self-contained database engine.
The FTS3 extension in SQLite enables full-text search capabilities, allowing users to perform advanced search operations on textual data.
The vulnerability allows remote attackers to execute arbitrary code on systems where SQLite with the FTS3 extension is enabled. This can lead to a complete compromise of the affected system.
To fix this vulnerability, update SQLite to version 3.25.3 or later, which includes a patch for the integer overflow and buffer overflow issues.
No, there is no known workaround for this vulnerability. It is crucial to apply the official fix by upgrading to a patched version of SQLite.
References
Related vulnerabilities
Recent vulnerabilities recorded for sqlite.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
