CVE-2020-27207: Use After Free

Q: Which deployments are most exposed to this issue?

SQLCipher 4.x deployments before 4.4.1 are affected. The described remote attack path relies on an application exposing SQL injection that allows an attacker to execute a crafted SQL command sequence.

Q: Does exploitation require authentication or user interaction?

The CVSS vector indicates no privileges and no user interaction are required. An attacker still needs a way to cause the vulnerable SQLCipher instance to process the crafted SQL sequence, such as a SQL injection path.

Q: What is the impact of a successful attack?

The documented impact is remote denial of service. The use-after-free can also cause unexpected RAM data to be read, although the supplied CVSS vector does not assign a confidentiality impact.

Q: What should teams do if they cannot immediately upgrade?

The provided attack example depends on SQL injection, so reducing or eliminating SQL injection opportunities limits the described remote exploitation path. SQLCipher versions before 4.4.1 remain affected until upgraded.

Published Nov 26, 2020

Updated

Zetetic SQLCipher 4.x before 4.4.1 has a use-after-free, related to sqlciphercodecpragma and sqlite3Strlen30 in sqlite3.c. A remote denial of service attack can be performed. For example, a SQL injection can be used to execute the crafted SQL command sequence. After that, some unexpected RAM data is read.

Affected Software

1 affected component

Zetetic SQLCipher>=4.0<4.4.1

Event History

Nov 26, 2020

CVE Published

via MITRE·04:41 PM

Data Sourced

via MITRE·04:41 PM

Description

Frequently Asked Questions

Which deployments are most exposed to this issue?

SQLCipher 4.x deployments before 4.4.1 are affected. The described remote attack path relies on an application exposing SQL injection that allows an attacker to execute a crafted SQL command sequence.

Does exploitation require authentication or user interaction?

The CVSS vector indicates no privileges and no user interaction are required. An attacker still needs a way to cause the vulnerable SQLCipher instance to process the crafted SQL sequence, such as a SQL injection path.

What is the impact of a successful attack?

The documented impact is remote denial of service. The use-after-free can also cause unexpected RAM data to be read, although the supplied CVSS vector does not assign a confidentiality impact.

What should teams do if they cannot immediately upgrade?

The provided attack example depends on SQL injection, so reducing or eliminating SQL injection opportunities limits the described remote exploitation path. SQLCipher versions before 4.4.1 remain affected until upgraded.

CVE-2020-27207: Use After Free

Affected Software

Event History

Frequently Asked Questions

Which deployments are most exposed to this issue?

Does exploitation require authentication or user interaction?

What is the impact of a successful attack?

What should teams do if they cannot immediately upgrade?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are most exposed to this issue?

Does exploitation require authentication or user interaction?

What is the impact of a successful attack?

What should teams do if they cannot immediately upgrade?