3 ms·
"If you use a device or software that uses SQLite or Chromium, it will be affected." If I write a hello world C program that does some sort of IO with SQLite,
by rhexs 8y ago
"If you use a device or software that uses SQLite or Chromium, it will be affected."
If I write a hello world C program that does some sort of IO with SQLite, it will be vulnerable to remote code execution? (if this turns out to be true, that will be quite impressive!)
Guessing something was lost in translation there. Sounds more like someone found a way to get code execution if you can inject certain data into SQLite, then found various applications that expose this functionality remotely?
- sebazzz 8y agoProbably they found the vulnerability through Chromium, then extended that to "everything that uses SQLite". Hard to tell anything without more details though. But if that is the case this is huge. SQLite is used in many places nowadays: Websites, browsers (Chromium and Firefox, I know of), various software including some Android apps. That also probably means the attack vector is some procedure where input is sanitized (assuming SQLite provides that, I never programmed against the C API).
- ronsor 8y agoWebKit; worse off, WebKit and Chromium expose SQLite almost directly through WebSQL! Drive-by malware!
- jakeogh 8y agoIf I understand correctly, it requires JS to be enabled (which it is usually). (Edit: wrong term, it's not "HTML5 Local Storage", it's "HTML5 Database" thanks): Chromium (EDIT: idk yet) Webkit2: https://webkitgtk.org/reference/webkit2gtk/stable/WebKitSettings.html#WebKitSettings--enable-html5-database https://webkitgtk.org/reference/webkit2gtk/stable/WebKitSett...
- ronsor 8y agoDrive-by malware used to require Flash or Java... which used to always be enabled. Edit: don't disable local storage! you'll break lots of things that way, and I don't think that includes WebSQL.
- cjensen 8y agoYeah, that's obvious nonsense. Merely using SQLite in your app does not open a port. How, exactly, are you going to be "vulnerable to remote code execution" when you don't use any network connections? And the phrase "uses SQLite or Chromium" is pretty close to gibberish. Those two things... are not really related.
- dragonwriter 8y agoDoesn't Chromium (like lots of other software) embed SQLite? So using Chromium would be (a potentially easily overlooked way) of using SQLite?
- ronsor 8y agoYes it does, and it makes sense to mention it because Chrome and Chromium are very popular and widespread, but many may not know it uses SQLite.
- ru999gol 8y agoIts a fairly special case where any website can execute arbitrary SQL due to WebDB. It should be mentioned that this is deprecated: https://hacks.mozilla.org/2010/06/beyond-html5-database-apis-and-the-road-to-indexeddb/ https://hacks.mozilla.org/2010/06/beyond-html5-database-apis...
- zaphar 8y agoYeah and that deprecated feature will probably still be around failing to totally die a decade from now.
- cjensen 8y agoThat would be "Chromium and SQLite", which is a combination that makes sense. "Or" doesn't make sense.