Sign-up

ID

VAR-201511-0044


CVE

CVE-2015-7036


TITLE

Apple iOS and Apple OS X Used in SQLite of fts3_tokenizer Vulnerability in arbitrary code execution in function

Trust: 0.8

sources: JVNDB: JVNDB-2015-006000

DESCRIPTION

The fts3_tokenizer function in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a SQL command that triggers an API call with a crafted pointer value in the second argument. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of SQLite. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the handling of the fts3_tokenizer function. The issue lies in the optional second argument which is expected to be a pointer into a structure. An attacker can leverage this vulnerability to achieve code execution under the context of the current process. Both Apple iOS and OS X are operating systems of Apple Inc. in the United States. Apple iOS was developed for mobile devices; OS X was developed for Mac computers. SQLite is an open source embedded relational database management system based on C language developed by American software developer D.Richard Hipp. A security vulnerability exists in the 'fts3_tokenizer' function in SQLite used in Apple iOS versions prior to 8.4 and OS X versions prior to 10.10.4. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201612-21 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: SQLite: Multiple vulnerabilities Date: December 08, 2016 Bugs: #549258, #574420 ID: 201612-21 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities were found in SQLite, the worst of which may allow execution of arbitrary code. Background ========== SQLite is a C library that implements an SQL database engine. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-db/sqlite < 3.11.1 >= 3.11.1 Description =========== Multiple vulnerabilities have been discovered in SQLite. Please review the CVE identifiers referenced below for details. Workaround ========== There is no known workaround at this time. Resolution ========== All sqlite users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=dev-db/sqlite-3.11.1" References ========== [ 1 ] CVE-2015-7036 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7036 [ 2 ] Two invalid read errors / heap overflows in SQLite (TFPA 006/2015) http://blog.fuzzing-project.org/10-Two-invalid-read-errors-heap-ove= rflows-in-SQLite-TFPA-0062015.html Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201612-21 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2016 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. http://creativecommons.org/licenses/by-sa/2.5

Trust: 2.79

sources: NVD: CVE-2015-7036 // JVNDB: JVNDB-2015-006000 // ZDI: ZDI-15-570 // BID: 77646 // VULHUB: VHN-84997 // VULMON: CVE-2015-7036 // PACKETSTORM: 140086

AFFECTED PRODUCTS

vendor:applemodel:mac os xscope:lteversion:10.10.3

Trust: 1.0

vendor:applemodel:iphone osscope:lteversion:8.3

Trust: 1.0

vendor:applemodel:mac os xscope:eqversion:10.10 to 10.10.3

Trust: 0.8

vendor:applemodel:iosscope:ltversion:8.4 (ipad 2 or later )

Trust: 0.8

vendor:applemodel:iosscope:ltversion:8.4 (iphone 4s or later )

Trust: 0.8

vendor:applemodel:iosscope:ltversion:8.4 (ipod touch first 5 after generation )

Trust: 0.8

vendor:sqlitemodel:sqlitescope: - version: -

Trust: 0.7

vendor:applemodel:mac os xscope:eqversion:10.10.3

Trust: 0.6

vendor:applemodel:iphone osscope:eqversion:8.3

Trust: 0.6

vendor:sqlitemodel:sqlitescope:eqversion:0

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.10.3

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.10.2

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.10.1

Trust: 0.3

vendor:applemodel:mac osscope:eqversion:x10.10

Trust: 0.3

vendor:applemodel:mac osscope:neversion:x10.10.4

Trust: 0.3

sources: ZDI: ZDI-15-570 // BID: 77646 // JVNDB: JVNDB-2015-006000 // CNNVD: CNNVD-201511-341 // NVD: CVE-2015-7036

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-7036
value: HIGH

Trust: 1.0

NVD: CVE-2015-7036
value: HIGH

Trust: 0.8

ZDI: CVE-2015-7036
value: HIGH

Trust: 0.7

CNNVD: CNNVD-201511-341
value: HIGH

Trust: 0.6

VULHUB: VHN-84997
value: HIGH

Trust: 0.1

VULMON: CVE-2015-7036
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2015-7036
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 2.6

VULHUB: VHN-84997
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: ZDI: ZDI-15-570 // VULHUB: VHN-84997 // VULMON: CVE-2015-7036 // JVNDB: JVNDB-2015-006000 // CNNVD: CNNVD-201511-341 // NVD: CVE-2015-7036

PROBLEMTYPE DATA

problemtype:CWE-20

Trust: 1.9

sources: VULHUB: VHN-84997 // JVNDB: JVNDB-2015-006000 // NVD: CVE-2015-7036

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201511-341

TYPE

input validation

Trust: 0.6

sources: CNNVD: CNNVD-201511-341

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-006000

PATCH
title:HT204942url:https://support.apple.com/en-us/HT204942
Trust: 1.5
title:Apple security updatesurl:https://support.apple.com/en-us/HT201222
Trust: 0.8
title:APPLE-SA-2015-06-30-2 OS X Yosemite v10.10.4 and Security Update 2015-005url:http://lists.apple.com/archives/security-announce/2015/Jun/msg00002.html
Trust: 0.8
title:APPLE-SA-2015-06-30-1 iOS 8.4url:http://lists.apple.com/archives/security-announce/2015/Jun/msg00001.html
Trust: 0.8
title:HT204941url:https://support.apple.com/en-us/HT204941
Trust: 0.8
title:HT204942url:http://support.apple.com/ja-jp/HT204942
Trust: 0.8
title:HT204941url:http://support.apple.com/ja-jp/HT204941
Trust: 0.8
title:Apple iOS  and OS X SQLite Fixes for remote code execution vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=58814
Trust: 0.6
title:The Registerurl:https://www.theregister.co.uk/2019/08/10/memory_corruption_sqlite/
Trust: 0.2
title:Red Hat: CVE-2015-7036url:https://vulmon.com/vendoradvisory?qidtp=red_hat_cve_database&qid=CVE-2015-7036
Trust: 0.1
title:Tenable Security Advisories: [R3] PVS 5.1.0 Fixes Multiple Third-party Library Vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=tenable_security_advisories&qid=TNS-2016-13
Trust: 0.1
title:Apple: OS X Yosemite v10.10.4 and Security Update 2015-005url:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=50398602701d671602946005c7864211
Trust: 0.1
sources:
            
            
            ZDI: ZDI-15-570 // 
            
            
            
            VULMON: CVE-2015-7036 // 
            
            
            
            JVNDB: JVNDB-2015-006000 // 
            
            
            
            CNNVD: CNNVD-201511-341

EXTERNAL IDS
db:NVDid:CVE-2015-7036
Trust: 3.7
db:ZDIid:ZDI-15-570
Trust: 2.8
db:BIDid:77646
Trust: 1.1
db:JVNDBid:JVNDB-2015-006000
Trust: 0.8
db:ZDI_CANid:ZDI-CAN-2888
Trust: 0.7
db:CNNVDid:CNNVD-201511-341
Trust: 0.7
db:SEEBUGid:SSVID-89914
Trust: 0.1
db:VULHUBid:VHN-84997
Trust: 0.1
db:TENABLEid:TNS-2016-13
Trust: 0.1
db:VULMONid:CVE-2015-7036
Trust: 0.1
db:PACKETSTORMid:140086
Trust: 0.1
sources:
            
            
            ZDI: ZDI-15-570 // 
            
            
            
            VULHUB: VHN-84997 // 
            
            
            
            VULMON: CVE-2015-7036 // 
            
            
            
            BID: 77646 // 
            
            
            
            JVNDB: JVNDB-2015-006000 // 
            
            
            
            PACKETSTORM: 140086 // 
            
            
            
            CNNVD: CNNVD-201511-341 // 
            
            
            
            NVD: CVE-2015-7036

REFERENCES
url:http://support.apple.com/kb/ht204941
Trust: 1.8
url:http://support.apple.com/kb/ht204942
Trust: 1.8
url:http://zerodayinitiative.com/advisories/zdi-15-570/
Trust: 1.8
url:https://security.gentoo.org/glsa/201612-21
Trust: 1.3
url:https://support.apple.com/en-us/ht204942
Trust: 1.0
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-7036
Trust: 0.9
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-7036
Trust: 0.8
url:http://www.securityfocus.com/bid/77646
Trust: 0.7
url:https://www.sqlite.org/
Trust: 0.3
url:http://www.zerodayinitiative.com/advisories/zdi-15-570/
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/20.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://access.redhat.com/security/cve/cve-2015-7036
Trust: 0.1
url:https://www.tenable.com/security/tns-2016-13
Trust: 0.1
url:http://creativecommons.org/licenses/by-sa/2.5
Trust: 0.1
url:https://security.gentoo.org/
Trust: 0.1
url:https://bugs.gentoo.org.
Trust: 0.1
url:http://blog.fuzzing-project.org/10-two-invalid-read-errors-heap-ove=
Trust: 0.1
sources:
            
            
            ZDI: ZDI-15-570 // 
            
            
            
            VULHUB: VHN-84997 // 
            
            
            
            VULMON: CVE-2015-7036 // 
            
            
            
            BID: 77646 // 
            
            
            
            JVNDB: JVNDB-2015-006000 // 
            
            
            
            PACKETSTORM: 140086 // 
            
            
            
            CNNVD: CNNVD-201511-341 // 
            
            
            
            NVD: CVE-2015-7036

CREDITS
Peter Rutenbar
Trust: 1.6
sources:
            
            
            ZDI: ZDI-15-570 // 
            
            
            
            BID: 77646 // 
            
            
            
            CNNVD: CNNVD-201511-341

SOURCES
db:ZDIid:ZDI-15-570
db:VULHUBid:VHN-84997
db:VULMONid:CVE-2015-7036
db:BIDid:77646
db:JVNDBid:JVNDB-2015-006000
db:PACKETSTORMid:140086
db:CNNVDid:CNNVD-201511-341
db:NVDid:CVE-2015-7036

LAST UPDATE DATE
2024-11-23T22:01:40.607000+00:00

SOURCES UPDATE DATE
db:ZDIid:ZDI-15-570date:2015-11-18T00:00:00
db:VULHUBid:VHN-84997date:2017-07-01T00:00:00
db:VULMONid:CVE-2015-7036date:2017-07-01T00:00:00
db:BIDid:77646date:2015-11-18T00:00:00
db:JVNDBid:JVNDB-2015-006000date:2015-11-24T00:00:00
db:CNNVDid:CNNVD-201511-341date:2015-11-23T00:00:00
db:NVDid:CVE-2015-7036date:2024-11-21T02:36:05.343

SOURCES RELEASE DATE
db:ZDIid:ZDI-15-570date:2015-11-18T00:00:00
db:VULHUBid:VHN-84997date:2015-11-22T00:00:00
db:VULMONid:CVE-2015-7036date:2015-11-22T00:00:00
db:BIDid:77646date:2015-11-18T00:00:00
db:JVNDBid:JVNDB-2015-006000date:2015-11-24T00:00:00
db:PACKETSTORMid:140086date:2016-12-08T23:46:27
db:CNNVDid:CNNVD-201511-341date:2015-11-20T00:00:00
db:NVDid:CVE-2015-7036date:2015-11-22T03:59:02.953