Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5497 > unrolled thread

"Magellan" bug in sqlite3

Back to article view | Back to linux.debian.security

Contents

  "Magellan" bug in sqlite3 Hideki Yamane <henrich@iijmio-mail.jp> - 2018-12-17 07:00 +0100
    Re: "Magellan" bug in sqlite3 qmi <lista@miklos.info> - 2018-12-18 23:40 +0100
      Re: "Magellan" bug in sqlite3 Hideki Yamane <henrich@iijmio-mail.jp> - 2018-12-19 08:50 +0100
        Re: "Magellan" bug in sqlite3 qmi <lista@miklos.info> - 2018-12-19 19:50 +0100
          Re: "Magellan" bug in sqlite3 Christoph Moench-Tegeder <cmt@burggraben.net> - 2018-12-20 00:40 +0100
            Re: "Magellan" bug in sqlite3 qmi <lista@miklos.info> - 2018-12-20 22:10 +0100
    Re: "Magellan" bug in sqlite3 László Böszörményi (GCS) <gcs@debian.org> - 2018-12-20 09:10 +0100
      Re: "Magellan" bug in sqlite3 Hideki Yamane <henrich@iijmio-mail.jp> - 2018-12-24 20:40 +0100

#5497 — "Magellan" bug in sqlite3

Hi,

 It may be known already but https://security-tracker.debian.org/tracker/source-package/sqlite3
 doesn't contain its vulnerability information.

 Tencent Blade Team released a security advisory about "Magellan" bug
 in sqlite, that was fixed in upstream 3.26.0.
 See https://blade.tencent.com/magellan/index_en.html

 CVE is not assigned yet, but we should track and try to fix it.



-- 
Hideki Yamane <henrich@iijmio-mail.jp>

[toc] | [next] | [standalone]

#5498

Hi

This vulnerability seems to have been already handled. See URL:
https://security-tracker.debian.org/tracker/TEMP-0566326-9A899F

But no CVE assigned as this is not public yet. 

Additionally, the Tencent team's page itself on the link referred by
you state that in order to apply the fix, update to 3.26.0 version.
The Debian package in unstable/sid is already at 3.26.0-3. This also
indicates that the issue is already handled.

https://packages.debian.org/sid/sqlite3

On Mon, Dec 17, 2018 at 02:20:25PM +0900, Hideki Yamane wrote:
>  Tencent Blade Team released a security advisory about "Magellan" bug
>  in sqlite, that was fixed in upstream 3.26.0.
>  See https://blade.tencent.com/magellan/index_en.html
> 
>  CVE is not assigned yet, but we should track and try to fix it.
> 
> -- 
> Hideki Yamane <henrich@iijmio-mail.jp>

Tell me if I am wrong. 

Regards,
-- 
qmi | Debian GNU/Linux enthusiast
Email: lista@miklos.info
WWW: http://www.miklos.info
GPG: 3C4B 1364 A379 7366 7FED  260A 2208 F2CE 3FCE A0D3

[toc] | [prev] | [next] | [standalone]

#5499

On Tue, 18 Dec 2018 23:36:24 +0100
qmi <lista@miklos.info> wrote:
> This vulnerability seems to have been already handled. See URL:
> https://security-tracker.debian.org/tracker/TEMP-0566326-9A899F

 At that time, there's no info.

> But no CVE assigned as this is not public yet. 

 Yes.

> Additionally, the Tencent team's page itself on the link referred by
> you state that in order to apply the fix, update to 3.26.0 version.
> The Debian package in unstable/sid is already at 3.26.0-3. This also
> indicates that the issue is already handled.

 No, we should deal with it in stable release, so tracking is important.


-- 
Hideki Yamane <henrich@iijmio-mail.jp>

[toc] | [prev] | [next] | [standalone]

#5500

Hi

On Wed, Dec 19, 2018 at 04:40:36PM +0900, Hideki Yamane wrote:
> On Tue, 18 Dec 2018 23:36:24 +0100
> qmi <lista@miklos.info> wrote:
> > This vulnerability seems to have been already handled. See URL:
> > https://security-tracker.debian.org/tracker/TEMP-0566326-9A899F
> 
>  No, we should deal with it in stable release, so tracking is important.
> 
Please check the link above once again. When a security issue is found
and fixed in unstable/sid, it is usually fixed (i.e.: backported) in
stable as well. Currently stable Debian release is codenamed 'stretch':

"
stretch	3.16.2-5+deb9u1	fixed
"

It is fixed, please update your system.

Regards,
-- 
qmi | Debian GNU/Linux enthusiast
Email: lista@miklos.info
WWW: http://www.miklos.info
GPG: 3C4B 1364 A379 7366 7FED  260A 2208 F2CE 3FCE A0D3

[toc] | [prev] | [next] | [standalone]

#5501

## qmi (lista@miklos.info):

> > > This vulnerability seems to have been already handled. See URL:
> > > https://security-tracker.debian.org/tracker/TEMP-0566326-9A899F
> > 
> >  No, we should deal with it in stable release, so tracking is important.
> > 
> Please check the link above once again.

Oh well, let's do that, by all means:
- the description reads "sqlite: info leak" - that's not the remote
  code execution Tencent has found.
- following the linked bug #566326 - which is from 2010 - the title is
  "xulrunner-1.9: iceweasel "clear private data" leaves traces on disk
  due to linkage to system libsqlite3 instead of embedded copy"

I conclude that "TEMP-0566326-9A899F" is not the vulnerability Tencent
as dubbed "Magellan".

Further, "TEMP-0566326-9A899F" claims sqlite3 package 3.16.2-5+deb9u1
as "fixed" - on the first machine I checked, that version had been
installed somewhat overan year ago, according to dpkg.log (on 2017-12-09,
to be more exact). (It would be entirely possible that 3.16 is just
too old to be vulnerable - but no such luck, read on).

In fact, PTS at https://tracker.debian.org/pkg/sqlite3 lists "2 security
issues in stretch", one of which is "TEMP-0000000-AAC0D0" with description
""Magellan" remote code execution vulnerability". That one lists sqlite3
version 3.26.0 as vulnerable - which, according to all available sources -
is the fixed version (Tencent: "If your product uses SQLite, please update
to 3.26.0"). I guess this will need fixing?

The fact that Tencent's announcement is thin on detail and thick on alarum
(and we have no official tracking reference and no statement from SQLite
themselves (except a few twitter blurbs)) makes this harder than it
should be...

Regards,
Christoph

-- 
Spare Space

[toc] | [prev] | [next] | [standalone]

#5503

On Thu, Dec 20, 2018 at 12:36:23AM +0100, Christoph Moench-Tegeder wrote:
> > > > This vulnerability seems to have been already handled. See URL:
> > > > https://security-tracker.debian.org/tracker/TEMP-0566326-9A899F
> > > 
> > >  No, we should deal with it in stable release, so tracking is important.
> > > 
> > Please check the link above once again.
> 
> Oh well, let's do that, by all means:
> - the description reads "sqlite: info leak" - that's not the remote
>   code execution Tencent has found.
In the Tencent link you can read, 1.'Remote code execution, leaking program
memory or causing program crashes.' and:
2.'Magellan is a number of vulnerabilities that exist in SQLite.' and:
3.'so this vulnerability has a wide range of influence.' and:
4.'We follow the responsible vulnerability disclosure process and will
not disclose the details of the vulnerability in advance... '

The above points 1.2.3.4. might indicate information leakage vulnerability
_as well_.

> I conclude that "TEMP-0566326-9A899F" is not the vulnerability Tencent
> as dubbed "Magellan".
Now we do know yes, after further research which you pointed out. My
answer was originally, '...seems to have been...'. Not affirmative,
but rather guiding.

Until there is no clear information on the issue, you cannot conclude
it 100% sure what it is exactly about and under which CVE/tracker ID
is tracked despite whatever name it is dubbed as.

> In fact, PTS at https://tracker.debian.org/pkg/sqlite3 lists "2 security
> issues in stretch", one of which is "TEMP-0000000-AAC0D0" with description
> ""Magellan" remote code execution vulnerability". That one lists sqlite3
> version 3.26.0 as vulnerable - which, according to all available sources -
> is the fixed version (Tencent: "If your product uses SQLite, please update
> to 3.26.0"). I guess this will need fixing?

This is correct, it looks it needs fixing in stretch/jessie, it is clearly stated. 
Not in sid, though, The correct tracker ID is 
https://security-tracker.debian.org/tracker/TEMP-0000000-AAC0D0 as you stated, 
though, I assume that this has been just added very recently.

Anyway, the point here is not which exact tracker deals with the issue
but to dismiss the false assumption that the reader might have come to,
namely, the security issues are not handled - or to be seen not handled -
properly in Debian Linux.

(... 'CVE is not assigned yet, but we should track and try to fix it.' ... )

Regards,
-- 
qmi | Debian GNU/Linux enthusiast
Email: lista@miklos.info
WWW: http://www.miklos.info
GPG: 3C4B 1364 A379 7366 7FED  260A 2208 F2CE 3FCE A0D3

[toc] | [prev] | [next] | [standalone]

#5502

On Mon, Dec 17, 2018 at 6:21 AM Hideki Yamane <henrich@iijmio-mail.jp> wrote:
>  It may be known already but https://security-tracker.debian.org/tracker/source-package/sqlite3
>  doesn't contain its vulnerability information.
 I've sent a detailed analysis of the possible issue back then to the
Security Team. A bit later I had to go off the grid, but now back on
track with some public details.

>  Tencent Blade Team released a security advisory about "Magellan" bug
>  in sqlite, that was fixed in upstream 3.26.0.
>  See https://blade.tencent.com/magellan/index_en.html
 It's turned out to be an FTS3/FTS4 extension issue (that is, you are
safe if you don't use it). Upstream confirmed it[1] and fix is
available[2]. First fixed version is 3.25.3 but due to other security
related fixes like an OOM[3] you are better upgrade to the 3.26.0
release.
Only Chrome seems to be affected due to WebSQL usage.

Regards,
Laszlo/GCS
[1] https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg113218.html
[2] https://www.sqlite.org/src/info/940f2adc8541a838
[3] https://www.sqlite.org/src/info/de0781485701c138

[toc] | [prev] | [next] | [standalone]

#5505

Hi,

On Thu, 20 Dec 2018 09:05:57 +0100
László Böszörményi (GCS) <gcs@debian.org> wrote:
>  It's turned out to be an FTS3/FTS4 extension issue (that is, you are
> safe if you don't use it). Upstream confirmed it[1] and fix is
> available[2]. First fixed version is 3.25.3 but due to other security
> related fixes like an OOM[3] you are better upgrade to the 3.26.0
> release.
> Only Chrome seems to be affected due to WebSQL usage.
> 
> Regards,
> Laszlo/GCS
> [1] https://www.mail-archive.com/sqlite-users@mailinglists.sqlite.org/msg113218.html
> [2] https://www.sqlite.org/src/info/940f2adc8541a838
> [3] https://www.sqlite.org/src/info/de0781485701c138

 Thanks for your work!
 "Only Chrome seems to be affected" but how about chromium?


-- 
Regards,

 Hideki Yamane     henrich @ debian.org/iijmio-mail.jp

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web