News

Researchers from Cisco Talos found vulnerability in DBMS SQLite

In DBMS SQLite detected vulnerability CVE-2019-5018 that allows performing code in the system if it is possible to execute a SQL query, prepared by an attacker.

Problem arises from the SQLite 3.26 branch.

“SQLite implements the Window Functions feature of SQL, which allows queries over a subset, or “window,” of rows. This specific vulnerability lies in that “window” function”, — writes Cisco Talos expert Cory Duplantis.

Specially designed SQL-request SELECT can case turn to the already freed memory’s region (use-after-free) that can potentially be used for creation of exploit for code execution in the context of application that uses SQLite.

Vulnerability can be exploited in case if application allows transition of externally received SQL-constructions in SQLite.

For example, potential attack can be performed on Chrome and applications that use Chromium engine, as API WebSQL is realized above SQLite and turns to this DBMS for processing of SQL-requests from web-applications. For attack is enough to create web-page with malware JavaScript-code and make user open it in browser on the base of Chromiun engine.

The vulnerability is fixed in the SQLite 3.28 update without explicitly mentioning the correction of security problems.

SQLite is a client-sidedatabase management system contained in a C programming library.

Source: https://blog.talosintelligence.com

Polina Lisovskaya

I works as a marketing manager for years now and loves searching for interesting topics for you

Recent Posts

Remove Thenetaservices.com Pop-up Ads

About Thenetaservices.com Thenetaservices.com pop-ups can not introduce out of the blue. If you have actually…

16 hours ago

Remove Litdeetar.live Pop-up Ads

About Litdeetar.live Litdeetar.live pop-ups can not expose out of nowhere. If you have actually clicked…

16 hours ago

Remove Bugracibs.xyz Pop-up Ads

About Bugracibs.xyz Bugracibs.xyz pop-ups can not open out of nowhere. If you have actually clicked…

16 hours ago

Remove Colidunt.xyz Pop-up Ads

About Colidunt.xyz Colidunt.xyz pop-ups can not open out of nowhere. If you have clicked some…

2 days ago

Remove Myflisblog.com Pop-up Ads

About Myflisblog.com Myflisblog.com pop-ups can not open out of the blue. If you have clicked…

2 days ago

Remove Dofenpas.xyz Pop-up Ads

About Dofenpas.xyz Dofenpas.xyz pop-ups can not expose out of the blue. If you have clicked…

2 days ago