PT-2020-16662 · Zetetic+1 · Sqlcipher+1

Published 2020-11-07 · Updated 2024-10-17 · CVE-2020-27207

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Zetetic SQLCipher versions 4.x before 4.4.1

Description The issue is related to a use-after-free error, specifically involving sqlcipher codec pragma and sqlite3Strlen30 in sqlite3.c. This can lead to a remote denial of service attack. An example of exploitation includes using SQL injection to execute a crafted SQL command sequence, resulting in the reading of unexpected RAM data.

Recommendations For versions prior to 4.4.1, update to version 4.4.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of SQL commands that could lead to the exploitation of the sqlcipher codec pragma and sqlite3Strlen30 functions until a patch is applied.

Fix

DoS

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2020-3229

ALT-PU-2024-14056

CVE-2020-27207

Affected Products

Alt Linux

Sqlcipher

References · 9

• https://ubuntu.com/security/CVE-2020-27207 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-27207 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-27207 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-27207 · Security Note
• https://osv.dev/vulnerability/CVE-2020-27207 · Vendor Advisory
• https://github.com/sqlcipher/sqlcipher/compare/v4.4.0...v4.4.1 · Note
• https://t.me/cibsecurity/16874 · Telegram Post
• https://telekom.com/en/corporate-responsibility/data-protection-data-security/security/details/advisories-504842 · Note
• https://telekom.com/resource/blob/612796/9f221708832a465f03585a45d7f59b45/dl-201112-denial-of-serviceen-data.pdf · Note