Exploit in SQLite

[Thomas]

Read this Article:
https://blade.tencent.com/magellan/index_en.html

Magellan is a remote code execution vulnerability discovered by Tencent Blade Team that exists in SQLite. As a well-known database, SQLite is widely used in all modern mainstream operating systems and software, so this vulnerability has a wide range of influence. After testing Chromium was also affected by this vulnerability, Google has confirmed and fixed this vulnerability. We will not disclose any details of the vulnerability at this time, and we are pushing other vendors to fix this vulnerability as soon as possible.

       
Q & A

(1) Am I affected by the vulnerability?

If you use a device or software that uses SQLite or Chromium. It may be affected, depending on whether there is a suitable attack surface.

(2) What is the danger of this vulnerability?

Remote code execution, leaking program memory or causing program crashes.

(3) Does this vulnerability have exploit code?

Yes, we successfully exploited Google Home with this vulnerability, and we currently have no plans to disclose exploit code.

(4) What are the conditions for exploiting the vulnerability?

This vulnerability can be triggered remotely, such as accessing a particular web page in a browser,Or any scenario that can execute SQL statements.

(5) Has "Magellan" been abused in the wild?

We have not seen the case yet.

(6) Is there a workaround/fix?

We have reported all the details of the vulnerability to Google and they have fixed the vulnerability ( commit ). If your product uses Chromium, please update to the official stable version 71.0.3578.80( Release updates). If your product uses SQLite, please update to 3.26.0 ( Release updates).The CVE number is pending.