Vulnerabilities > CVE-2018-20506 - Integer Overflow or Wraparound vulnerability in multiple products

047910
CVSS 8.1 - HIGH
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
high complexity
sqlite
apple
opensuse
CWE-190
nessus

Summary

SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a "merge" operation that occurs after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346.

Vulnerable Configurations

Part Description Count
Application
Sqlite
291
Application
Apple
267
OS
Apple
443
OS
Microsoft
1
OS
Opensuse
1

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Forced Integer Overflow
    This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.

Nessus

  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-0913-1.NASL
    descriptionThis update for sqlite3 fixes the following issues : Security issues fixed : CVE-2018-20346: Fixed a remote code execution vulnerability in FTS3 (Magellan) (bsc#1119687). CVE-2018-20506: Fixed an integer overflow when FTS3 extension is enabled (bsc#1131576). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id123967
    published2019-04-10
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/123967
    titleSUSE SLED12 / SLES12 Security Update : sqlite3 (SUSE-SU-2019:0913-1)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from SUSE update advisory SUSE-SU-2019:0913-1.
    # The text itself is copyright (C) SUSE.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(123967);
      script_version("1.3");
      script_cvs_date("Date: 2020/01/23");
    
      script_cve_id("CVE-2018-20346", "CVE-2018-20506");
    
      script_name(english:"SUSE SLED12 / SLES12 Security Update : sqlite3 (SUSE-SU-2019:0913-1)");
      script_summary(english:"Checks rpm output for the updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote SUSE host is missing one or more security updates."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update for sqlite3 fixes the following issues :
    
    Security issues fixed :
    
    CVE-2018-20346: Fixed a remote code execution vulnerability in FTS3
    (Magellan) (bsc#1119687).
    
    CVE-2018-20506: Fixed an integer overflow when FTS3 extension is
    enabled (bsc#1131576).
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the SUSE security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1119687"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.suse.com/show_bug.cgi?id=1131576"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2018-20346/"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://www.suse.com/security/cve/CVE-2018-20506/"
      );
      # https://www.suse.com/support/update/announcement/2019/suse-su-20190913-1/
      script_set_attribute(
        attribute:"see_also",
        value:"http://www.nessus.org/u?ca5a55f9"
      );
      script_set_attribute(
        attribute:"solution", 
        value:
    "To install this SUSE Security Update use the SUSE recommended
    installation methods like YaST online_update or 'zypper patch'.
    
    Alternatively you can run the command listed for your product :
    
    SUSE OpenStack Cloud 7:zypper in -t patch
    SUSE-OpenStack-Cloud-7-2019-913=1
    
    SUSE Linux Enterprise Software Development Kit 12-SP4:zypper in -t
    patch SUSE-SLE-SDK-12-SP4-2019-913=1
    
    SUSE Linux Enterprise Software Development Kit 12-SP3:zypper in -t
    patch SUSE-SLE-SDK-12-SP3-2019-913=1
    
    SUSE Linux Enterprise Server for SAP 12-SP2:zypper in -t patch
    SUSE-SLE-SAP-12-SP2-2019-913=1
    
    SUSE Linux Enterprise Server for SAP 12-SP1:zypper in -t patch
    SUSE-SLE-SAP-12-SP1-2019-913=1
    
    SUSE Linux Enterprise Server 12-SP4:zypper in -t patch
    SUSE-SLE-SERVER-12-SP4-2019-913=1
    
    SUSE Linux Enterprise Server 12-SP3:zypper in -t patch
    SUSE-SLE-SERVER-12-SP3-2019-913=1
    
    SUSE Linux Enterprise Server 12-SP2-LTSS:zypper in -t patch
    SUSE-SLE-SERVER-12-SP2-2019-913=1
    
    SUSE Linux Enterprise Server 12-SP2-BCL:zypper in -t patch
    SUSE-SLE-SERVER-12-SP2-BCL-2019-913=1
    
    SUSE Linux Enterprise Server 12-SP1-LTSS:zypper in -t patch
    SUSE-SLE-SERVER-12-SP1-2019-913=1
    
    SUSE Linux Enterprise Desktop 12-SP4:zypper in -t patch
    SUSE-SLE-DESKTOP-12-SP4-2019-913=1
    
    SUSE Linux Enterprise Desktop 12-SP3:zypper in -t patch
    SUSE-SLE-DESKTOP-12-SP3-2019-913=1
    
    SUSE Enterprise Storage 4:zypper in -t patch SUSE-Storage-4-2019-913=1
    
    SUSE CaaS Platform ALL :
    
    To install this update, use the SUSE CaaS Platform Velum dashboard. It
    will inform you if it detects new updates and let you then trigger
    updating of the complete cluster in a controlled way.
    
    SUSE CaaS Platform 3.0 :
    
    To install this update, use the SUSE CaaS Platform Velum dashboard. It
    will inform you if it detects new updates and let you then trigger
    updating of the complete cluster in a controlled way.
    
    OpenStack Cloud Magnum Orchestration 7:zypper in -t patch
    SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2019-913=1"
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libsqlite3");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libsqlite3-0");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:libsqlite3-0-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:sqlite3");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:sqlite3-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:suse_linux:sqlite3-debugsource");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:suse_linux:12");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/12/21");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/04/09");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/04/10");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release !~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "SUSE");
    os_ver = pregmatch(pattern: "^(SLE(S|D)\d+)", string:release);
    if (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, "SUSE");
    os_ver = os_ver[1];
    if (! preg(pattern:"^(SLED12|SLES12)$", string:os_ver)) audit(AUDIT_OS_NOT, "SUSE SLED12 / SLES12", "SUSE " + os_ver);
    
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if (cpu !~ "^i[3-6]86$" && "x86_64" >!< cpu && "s390x" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "SUSE " + os_ver, cpu);
    
    sp = get_kb_item("Host/SuSE/patchlevel");
    if (isnull(sp)) sp = "0";
    if (os_ver == "SLES12" && (! preg(pattern:"^(1|2|3|4)$", string:sp))) audit(AUDIT_OS_NOT, "SLES12 SP1/2/3/4", os_ver + " SP" + sp);
    if (os_ver == "SLED12" && (! preg(pattern:"^(3|4)$", string:sp))) audit(AUDIT_OS_NOT, "SLED12 SP3/4", os_ver + " SP" + sp);
    
    
    flag = 0;
    if (rpm_check(release:"SLES12", sp:"1", reference:"libsqlite3-0-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"1", reference:"libsqlite3-0-debuginfo-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"1", reference:"sqlite3-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"1", reference:"sqlite3-debuginfo-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"1", reference:"sqlite3-debugsource-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"1", reference:"libsqlite3-0-32bit-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"1", reference:"libsqlite3-0-debuginfo-32bit-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"4", reference:"libsqlite3-0-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"4", reference:"libsqlite3-0-debuginfo-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"4", reference:"sqlite3-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"4", reference:"sqlite3-debuginfo-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"4", reference:"sqlite3-debugsource-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"4", reference:"libsqlite3-0-32bit-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"4", reference:"libsqlite3-0-debuginfo-32bit-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"3", reference:"libsqlite3-0-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"3", reference:"libsqlite3-0-debuginfo-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"3", reference:"sqlite3-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"3", reference:"sqlite3-debuginfo-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"3", reference:"sqlite3-debugsource-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"3", reference:"libsqlite3-0-32bit-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"3", reference:"libsqlite3-0-debuginfo-32bit-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"libsqlite3-0-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"libsqlite3-0-32bit-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"libsqlite3-0-debuginfo-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"libsqlite3-0-debuginfo-32bit-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"sqlite3-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"sqlite3-debuginfo-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", cpu:"x86_64", reference:"sqlite3-debugsource-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", reference:"libsqlite3-0-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", reference:"libsqlite3-0-debuginfo-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", reference:"sqlite3-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", reference:"sqlite3-debuginfo-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", reference:"sqlite3-debugsource-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", reference:"libsqlite3-0-32bit-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLES12", sp:"2", reference:"libsqlite3-0-debuginfo-32bit-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libsqlite3-0-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libsqlite3-0-32bit-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libsqlite3-0-debuginfo-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"libsqlite3-0-debuginfo-32bit-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"sqlite3-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"sqlite3-debuginfo-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"4", cpu:"x86_64", reference:"sqlite3-debugsource-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libsqlite3-0-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libsqlite3-0-32bit-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libsqlite3-0-debuginfo-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"libsqlite3-0-debuginfo-32bit-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"sqlite3-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"sqlite3-debuginfo-3.8.10.2-9.3.1")) flag++;
    if (rpm_check(release:"SLED12", sp:"3", cpu:"x86_64", reference:"sqlite3-debugsource-3.8.10.2-9.3.1")) flag++;
    
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "sqlite3");
    }
    
  • NASL familyMacOS X Local Security Checks
    NASL idMACOS_10_14_3.NASL
    descriptionThe remote host is running a version of macOS / Mac OS X that is 10.14.x prior to 10.14.3. It is, therefore, affected by multiple vulnerabilities related to the following components: - AppleKeyStore - Bluetooth - Core Media - CoreAnimation - FaceTime - IOKit - Kernel - libxpc - Natural Language Processing - QuartzCore - SQLite - WebRTC Note that successful exploitation of the most serious issues can result in arbitrary code execution.
    last seen2020-06-01
    modified2020-06-02
    plugin id121393
    published2019-01-25
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121393
    titlemacOS 10.14.x < 10.14.3 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(121393);
      script_version("1.5");
      script_cvs_date("Date: 2019/10/31 15:18:51");
    
      script_cve_id(
        "CVE-2018-20346",
        "CVE-2018-20505",
        "CVE-2018-20506",
        "CVE-2019-6200",
        "CVE-2019-6202",
        "CVE-2019-6205",
        "CVE-2019-6208",
        "CVE-2019-6209",
        "CVE-2019-6210",
        "CVE-2019-6211",
        "CVE-2019-6213",
        "CVE-2019-6214",
        "CVE-2019-6218",
        "CVE-2019-6219",
        "CVE-2019-6220",
        "CVE-2019-6221",
        "CVE-2019-6224",
        "CVE-2019-6225",
        "CVE-2019-6230",
        "CVE-2019-6231",
        "CVE-2019-6235"
      );
      script_bugtraq_id(106323, 106693, 106694);
      script_xref(name:"APPLE-SA", value:"APPLE-SA-2019-1-22-2");
    
      script_name(english:"macOS 10.14.x < 10.14.3 Multiple Vulnerabilities");
      script_summary(english:"Checks the version of Mac OS X / macOS.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote host is missing a macOS update that fixes multiple security
    vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The remote host is running a version of macOS / Mac OS X that is
    10.14.x prior to 10.14.3. It is, therefore, affected by multiple
    vulnerabilities related to the following components:
    
      - AppleKeyStore
      - Bluetooth
      - Core Media
      - CoreAnimation
      - FaceTime
      - IOKit
      - Kernel
      - libxpc
      - Natural Language Processing
      - QuartzCore
      - SQLite
      - WebRTC
    
    Note that successful exploitation of the most serious issues can
    result in arbitrary code execution.");
      script_set_attribute(attribute:"see_also", value:"https://support.apple.com/en-us/HT209446");
      # https://lists.apple.com/archives/security-announce/2019/Jan/msg00001.html
      script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a77b9bea");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to macOS version 10.14.3 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:H/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:H/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2019-6218");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
      script_set_attribute(attribute:"exploited_by_malware", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2019/01/22");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/01/22");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/01/25");
    
      script_set_attribute(attribute:"plugin_type", value:"combined");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:mac_os_x");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:apple:macos");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"MacOS X Local Security Checks");
    
      script_copyright(english:"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("ssh_get_info.nasl", "os_fingerprint.nasl");
      script_require_ports("Host/MacOSX/Version", "Host/OS");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("misc_func.inc");
    
    
    fix = "10.14.3";
    minver = "10.14";
    
    os = get_kb_item("Host/MacOSX/Version");
    if (!os)
    {
      os = get_kb_item_or_exit("Host/OS");
      if ("Mac OS X" >!< os) audit(AUDIT_OS_NOT, "macOS / Mac OS X");
    
      c = get_kb_item("Host/OS/Confidence");
      if (c <= 70) exit(1, "Can't determine the host's OS with sufficient confidence.");
    }
    if (!os) audit(AUDIT_OS_NOT, "macOS / Mac OS X");
    
    matches = pregmatch(pattern:"Mac OS X ([0-9]+(\.[0-9]+)+)", string:os);
    if (empty_or_null(matches)) exit(1, "Failed to parse the macOS / Mac OS X version ('" + os + "').");
    
    version = matches[1];
    
    if (ver_compare(ver:version, minver:minver, fix:fix, strict:FALSE) == -1)
    {
      security_report_v4(
        port:0,
        severity:SECURITY_HOLE,
        extra:
          '\n  Installed version : ' + version +
          '\n  Fixed version     : ' + fix +
          '\n'
      );
    }
    else audit(AUDIT_INST_VER_NOT_VULN, "macOS / Mac OS X", version);
    
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-4019-1.NASL
    descriptionIt was discovered that SQLite incorrectly handled certain SQL files. An attacker could possibly use this issue to execute arbitrary code or cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-2518, CVE-2017-2520) It was discovered that SQLite incorrectly handled certain queries. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-20505) It was discovered that SQLite incorrectly handled certain queries. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-20346, CVE-2018-20506) It was discovered that SQLite incorrectly handled certain inputs. An attacker could possibly use this issue to access sensitive information. (CVE-2019-8457) It was discovered that SQLite incorrectly handled certain queries. An attacker could possibly use this issue to access sensitive information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2019-9936) It was discovered that SQLite incorrectly handled certain inputs. An attacker could possibly use this issue to cause a crash or execute arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2019-9937) It was discovered that SQLite incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-6153) It was discovered that SQLite incorrectly handled certain databases. An attacker could possibly use this issue to access sensitive information. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-10989) It was discovered that SQLite incorrectly handled certain files. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-13685) It was discovered that SQLite incorrectly handled certain queries. An attacker could possibly use this issue to execute arbitrary code or cause a denial of service. This issue only affected Ubuntu 16.04 LTS. (CVE-2017-2519). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id126065
    published2019-06-20
    reporterUbuntu Security Notice (C) 2019-2020 Canonical, Inc. / NASL script (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/126065
    titleUbuntu 16.04 LTS / 18.04 LTS / 18.10 / 19.04 : sqlite3 vulnerabilities (USN-4019-1)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from Ubuntu Security Notice USN-4019-1. The text 
    # itself is copyright (C) Canonical, Inc. See 
    # <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered 
    # trademark of Canonical, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(126065);
      script_version("1.3");
      script_cvs_date("Date: 2020/01/10");
    
      script_cve_id("CVE-2016-6153", "CVE-2017-10989", "CVE-2017-13685", "CVE-2017-2518", "CVE-2017-2519", "CVE-2017-2520", "CVE-2018-20346", "CVE-2018-20505", "CVE-2018-20506", "CVE-2019-8457", "CVE-2019-9936", "CVE-2019-9937");
      script_xref(name:"USN", value:"4019-1");
    
      script_name(english:"Ubuntu 16.04 LTS / 18.04 LTS / 18.10 / 19.04 : sqlite3 vulnerabilities (USN-4019-1)");
      script_summary(english:"Checks dpkg output for updated packages.");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:
    "The remote Ubuntu host is missing one or more security-related
    patches."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "It was discovered that SQLite incorrectly handled certain SQL files.
    An attacker could possibly use this issue to execute arbitrary code or
    cause a denial of service. This issue only affected Ubuntu 16.04 LTS.
    (CVE-2017-2518, CVE-2017-2520)
    
    It was discovered that SQLite incorrectly handled certain queries. An
    attacker could possibly use this issue to execute arbitrary code. This
    issue only affected Ubuntu 18.04 LTS and Ubuntu 18.10.
    (CVE-2018-20505)
    
    It was discovered that SQLite incorrectly handled certain queries. An
    attacker could possibly use this issue to execute arbitrary code. This
    issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04 LTS and Ubuntu
    18.10. (CVE-2018-20346, CVE-2018-20506)
    
    It was discovered that SQLite incorrectly handled certain inputs. An
    attacker could possibly use this issue to access sensitive
    information. (CVE-2019-8457)
    
    It was discovered that SQLite incorrectly handled certain queries. An
    attacker could possibly use this issue to access sensitive
    information. This issue only affected Ubuntu 16.04 LTS, Ubuntu 18.04
    LTS and Ubuntu 18.10. (CVE-2019-9936)
    
    It was discovered that SQLite incorrectly handled certain inputs. An
    attacker could possibly use this issue to cause a crash or execute
    arbitrary code. This issue only affected Ubuntu 16.04 LTS, Ubuntu
    18.04 LTS and Ubuntu 18.10. (CVE-2019-9937)
    
    It was discovered that SQLite incorrectly handled certain inputs. An
    attacker could possibly use this issue to cause a denial of service.
    This issue only affected Ubuntu 16.04 LTS. (CVE-2016-6153)
    
    It was discovered that SQLite incorrectly handled certain databases.
    An attacker could possibly use this issue to access sensitive
    information. This issue only affected Ubuntu 16.04 LTS.
    (CVE-2017-10989)
    
    It was discovered that SQLite incorrectly handled certain files. An
    attacker could possibly use this issue to cause a denial of service.
    This issue only affected Ubuntu 16.04 LTS. (CVE-2017-13685)
    
    It was discovered that SQLite incorrectly handled certain queries. An
    attacker could possibly use this issue to execute arbitrary code or
    cause a denial of service. This issue only affected Ubuntu 16.04 LTS.
    (CVE-2017-2519).
    
    Note that Tenable Network Security has extracted the preceding
    description block directly from the Ubuntu security advisory. Tenable
    has attempted to automatically clean and format it as much as possible
    without introducing additional issues."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://usn.ubuntu.com/4019-1/"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected libsqlite3-0 and / or sqlite3 packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:libsqlite3-0");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:sqlite3");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:16.04");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:18.04:-:lts");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:18.10");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:19.04");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/09/26");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/06/19");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/06/20");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"Ubuntu Security Notice (C) 2019-2020 Canonical, Inc. / NASL script (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"Ubuntu Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("ubuntu.inc");
    include("misc_func.inc");
    
    if ( ! get_kb_item("Host/local_checks_enabled") ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/Ubuntu/release");
    if ( isnull(release) ) audit(AUDIT_OS_NOT, "Ubuntu");
    release = chomp(release);
    if (! preg(pattern:"^(16\.04|18\.04|18\.10|19\.04)$", string:release)) audit(AUDIT_OS_NOT, "Ubuntu 16.04 / 18.04 / 18.10 / 19.04", "Ubuntu " + release);
    if ( ! get_kb_item("Host/Debian/dpkg-l") ) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    cpu = get_kb_item("Host/cpu");
    if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
    if ("x86_64" >!< cpu && cpu !~ "^i[3-6]86$") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, "Ubuntu", cpu);
    
    flag = 0;
    
    if (ubuntu_check(osver:"16.04", pkgname:"libsqlite3-0", pkgver:"3.11.0-1ubuntu1.2")) flag++;
    if (ubuntu_check(osver:"16.04", pkgname:"sqlite3", pkgver:"3.11.0-1ubuntu1.2")) flag++;
    if (ubuntu_check(osver:"18.04", pkgname:"libsqlite3-0", pkgver:"3.22.0-1ubuntu0.1")) flag++;
    if (ubuntu_check(osver:"18.04", pkgname:"sqlite3", pkgver:"3.22.0-1ubuntu0.1")) flag++;
    if (ubuntu_check(osver:"18.10", pkgname:"libsqlite3-0", pkgver:"3.24.0-1ubuntu0.1")) flag++;
    if (ubuntu_check(osver:"18.10", pkgname:"sqlite3", pkgver:"3.24.0-1ubuntu0.1")) flag++;
    if (ubuntu_check(osver:"19.04", pkgname:"libsqlite3-0", pkgver:"3.27.2-2ubuntu0.1")) flag++;
    if (ubuntu_check(osver:"19.04", pkgname:"sqlite3", pkgver:"3.27.2-2ubuntu0.1")) flag++;
    
    if (flag)
    {
      security_report_v4(
        port       : 0,
        severity   : SECURITY_HOLE,
        extra      : ubuntu_report_get()
      );
      exit(0);
    }
    else
    {
      tested = ubuntu_pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libsqlite3-0 / sqlite3");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idOPENSUSE-2019-1222.NASL
    descriptionThis update for sqlite3 fixes the following issues : Security issues fixed : - CVE-2018-20346: Fixed a remote code execution vulnerability in FTS3 (Magellan) (bsc#1119687). - CVE-2018-20506: Fixed an integer overflow when FTS3 extension is enabled (bsc#1131576). This update was imported from the SUSE:SLE-12-SP1:Update update project.
    last seen2020-06-01
    modified2020-06-02
    plugin id124143
    published2019-04-18
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124143
    titleopenSUSE Security Update : sqlite3 (openSUSE-2019-1222)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    # The descriptive text and package checks in this plugin were
    # extracted from openSUSE Security Update openSUSE-2019-1222.
    #
    # The text description of this plugin is (C) SUSE LLC.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(124143);
      script_version("1.2");
      script_cvs_date("Date: 2020/01/23");
    
      script_cve_id("CVE-2018-20346", "CVE-2018-20506");
    
      script_name(english:"openSUSE Security Update : sqlite3 (openSUSE-2019-1222)");
      script_summary(english:"Check for the openSUSE-2019-1222 patch");
    
      script_set_attribute(
        attribute:"synopsis", 
        value:"The remote openSUSE host is missing a security update."
      );
      script_set_attribute(
        attribute:"description", 
        value:
    "This update for sqlite3 fixes the following issues :
    
    Security issues fixed :
    
      - CVE-2018-20346: Fixed a remote code execution
        vulnerability in FTS3 (Magellan) (bsc#1119687).
    
      - CVE-2018-20506: Fixed an integer overflow when FTS3
        extension is enabled (bsc#1131576). 
    
    This update was imported from the SUSE:SLE-12-SP1:Update update
    project."
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1119687"
      );
      script_set_attribute(
        attribute:"see_also",
        value:"https://bugzilla.opensuse.org/show_bug.cgi?id=1131576"
      );
      script_set_attribute(
        attribute:"solution", 
        value:"Update the affected sqlite3 packages."
      );
      script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libsqlite3-0");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libsqlite3-0-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libsqlite3-0-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:libsqlite3-0-debuginfo-32bit");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:sqlite3");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:sqlite3-debuginfo");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:sqlite3-debugsource");
      script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:sqlite3-devel");
      script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:42.3");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2018/12/21");
      script_set_attribute(attribute:"patch_publication_date", value:"2019/04/17");
      script_set_attribute(attribute:"plugin_publication_date", value:"2019/04/18");
      script_set_attribute(attribute:"generated_plugin", value:"current");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_copyright(english:"This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
      script_family(english:"SuSE Local Security Checks");
    
      script_dependencies("ssh_get_info.nasl");
      script_require_keys("Host/local_checks_enabled", "Host/SuSE/release", "Host/SuSE/rpm-list", "Host/cpu");
    
      exit(0);
    }
    
    
    include("audit.inc");
    include("global_settings.inc");
    include("rpm.inc");
    
    if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
    release = get_kb_item("Host/SuSE/release");
    if (isnull(release) || release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, "openSUSE");
    if (release !~ "^(SUSE42\.3)$") audit(AUDIT_OS_RELEASE_NOT, "openSUSE", "42.3", release);
    if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);
    
    ourarch = get_kb_item("Host/cpu");
    if (!ourarch) audit(AUDIT_UNKNOWN_ARCH);
    if (ourarch !~ "^(i586|i686|x86_64)$") audit(AUDIT_ARCH_NOT, "i586 / i686 / x86_64", ourarch);
    
    flag = 0;
    
    if ( rpm_check(release:"SUSE42.3", reference:"libsqlite3-0-3.8.10.2-11.3.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"libsqlite3-0-debuginfo-3.8.10.2-11.3.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"sqlite3-3.8.10.2-11.3.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"sqlite3-debuginfo-3.8.10.2-11.3.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"sqlite3-debugsource-3.8.10.2-11.3.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", reference:"sqlite3-devel-3.8.10.2-11.3.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", cpu:"x86_64", reference:"libsqlite3-0-32bit-3.8.10.2-11.3.1") ) flag++;
    if ( rpm_check(release:"SUSE42.3", cpu:"x86_64", reference:"libsqlite3-0-debuginfo-32bit-3.8.10.2-11.3.1") ) flag++;
    
    if (flag)
    {
      if (report_verbosity > 0) security_warning(port:0, extra:rpm_report_get());
      else security_warning(0);
      exit(0);
    }
    else
    {
      tested = pkg_tests_get();
      if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
      else audit(AUDIT_PACKAGE_NOT_INSTALLED, "libsqlite3-0 / libsqlite3-0-32bit / libsqlite3-0-debuginfo / etc");
    }
    
  • NASL familySuSE Local Security Checks
    NASL idSUSE_SU-2019-0973-1.NASL
    descriptionThis update for sqlite3 fixes the following issues : Security issues fixed : CVE-2018-20506: Fixed an integer overflow when FTS3 extension is enabled (bsc#1131576). CVE-2018-20346: Fixed a remote code execution vulnerability in FTS3 (Magellan) (bsc#1119687). CVE-2016-6153: Fixed incorrect permissions when creating temporary files (bsc#987394). Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id124150
    published2019-04-18
    reporterThis script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/124150
    titleSUSE SLES12 Security Update : sqlite3 (SUSE-SU-2019:0973-1)
  • NASL familyWindows
    NASL idITUNES_12_9_3.NASL
    descriptionThe version of Apple iTunes installed on the remote Windows host is prior to 12.9.3. It is, therefore, affected by multiple vulnerabilities as referenced in the HT209450 advisory: - Multiple vulnerabilities exist due to input processing flaws in the WebKit component. An attacker may be able to leverage one of these vulnerability, by providing maliciously crafted web content, to execute arbitrary code on the host. (CVE-2019-6212, CVE-2019-6215, CVE-2019-6216, CVE-2019-6217, CVE-2019-6226, CVE-2019-6227, CVE-2019-6233, CVE-2019-6234) - A universal cross-site scripting vulnerability exists in the WebKit component. An attacker may be able to leverage this vulnerability, by providing maliciously crafted web content, to execute arbitrary script code in the security context of any site. (CVE-2019-6229) - A memory corruption vulnerability exists in the AppleKeyStore component. An attacker may be able to leverage this vulnerability to allow a process to circumvent sandbox restrictions. (CVE-2019-6235) - An out-of-bounds read vulnerability exists in the Core Media component. An attacker may be able to leverage this vulnerability to allow a malicious application to elevate its privileges. (CVE-2019-6221) - Multiple memory corruption issues exist in the SQLite component. An attacker may be able to leverage these vulnerabilities, by executing a malicious SQL query, to execute arbitrary code on the host. (CVE-2018-20346, CVE-2018-20505, CVE-2018-20506) Note that Nessus has not tested for this issue but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id121473
    published2019-01-30
    reporterThis script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/121473
    titleApple iTunes < 12.9.3 Multiple Vulnerabilities (credentialed check)

References