3 ms·
An RCE in a non-networked component is interesting (in other words, obvious hyperbole). Either this is your usual corruption bug/vuln triggerable in some/many p
by blattimwind 8y ago
An RCE in a non-networked component is interesting (in other words, obvious hyperbole). Either this is your usual corruption bug/vuln triggerable in some/many programs using SQLite, or an actual bug in SQLite itself, e.g. query preparation (a fix/workaround being committed to SQLite doesn't necessarily imply one or the other). Whether the RCE hyperbole is justified remains to be seen.
Edit: Apparently the exploit vector is due to WebSQL.
And my guess as for the vulnerability area are "strategically corrupt databases", because there have been numerous commits related to this in the relevant SQLite releases and some seem like they were added relatively late in the process (e.g. after changing the VERSION file but before releasing).
- JaRail 8y agoThey mention the example of browsing to a web page. Not quite a fully fledged remote execution bug but close enough. I think what they're really saying is they're aware of remote execution cases. An example of that might be a web services that's backed by a SQLite query.
- 21 8y agoJavaScript code has access to SQLite. So any webpage where the attacker controls/can inject JavaScript is vulnerable.
- blattimwind 8y agoFirefox has never supported WebSQL...
- tptacek 8y agoDrive-by code execution from a page in a web browser is almost the textbook example of "RCE" in its modern sense.
- GalacticDomin8r 8y agoYeah, of the browser or plugin. SQLite is neither although does have a local exploit.
- deleted 8y ago[deleted]