SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled.

According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.2.2. It is, therefore, affected by multiple vulnerabilities as referenced in the TNS-2023-23 advisory. Several of the third-party components were found to contain vulnerabilities, and updated versions have been made available by the providers. Out of caution and in line with best practice, Tenable has opted to upgrade these components to address the potential impact of the issues. Nessus Network Monitor 6.2.2 updates the following components:

  - c-ares from version 1.10.0 to version 1.19.1.
  - curl from version 7.79.1 to version 8.1.2.
  - libbzip2 from version 1.0.6 to version 1.0.8.
  - libpcre from version 8.42 to version 8.44.
  - libxml2 from version 2.7.7 to version 2.11.1.
  - libxslt from version 1.1.26 to version 1.1.37.
  - libxmlsec from version 1.2.18 to version 1.2.37.
  - sqlite from version 3.27.2 to version 3.40.1.
  - jQuery Cookie from version 1.3.1 to version 1.4.1.
  - jQuery UI from version 1.13.0 to version 1.13.2.
  - OpenSSL from version 3.0.8 to version 3.0.9.

The version of Junos OS installed on the remote host is affected by multiple vulnerabilities as referenced in the JSA69705 advisory.

  - ** DISPUTED ** A segmentation fault can occur in the sqlite3.exe command-line component of SQLite 3.36.0     via the idxGetTableInfo function when there is a crafted SQL query. NOTE: the vendor disputes the     relevance of this report because a sqlite3.exe user already has full privileges (e.g., is intentionally     allowed to execute commands). This report does NOT imply any problem in the SQLite library.
    (CVE-2021-36690)

  - A flaw was found in SQLite's SELECT query functionality (src/select.c). This flaw allows an attacker who     is capable of running SQL queries locally on the SQLite database to cause a denial of service or possible     code execution by triggering a use-after-free. The highest threat from this vulnerability is to system     availability. (CVE-2021-20227)

  - In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy     heap overflow because of misuse of transitive properties for constant propagation. (CVE-2020-15358)

  - SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for     window functions is too late. (CVE-2020-13871)

  - ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo()     query. (CVE-2020-13632)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to its self-reported version, the Tenable SecurityCenter application installed on the remote host is less than 5.19.0 and is therefore affected by multiple vulnerabilities in the following components: 
  - Apache FOP
  - Underscore
  - Handlebars
  - PHP
  - sqlite

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

An update of the mysql package has been released.

The remote host is affected by the vulnerability described in GLSA-202007-26 (SQLite: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in SQLite. Please review       the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

According to the versions of the sqlite packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities :

  - SQLite through 3.31.1 allows attackers to cause a     denial of service (segmentation fault) via a malformed     window-function query because the AggInfo object's     initialization is mishandled.(CVE-2020-11655)

  - ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a     NULL pointer dereference via a crafted matchinfo()     query.(CVE-2020-13632)

  - ext/fts3/fts3.c in SQLite before 3.32.0 has a     use-after-free in fts3EvalNextRow, related to the     snippet feature.(CVE-2020-13630)

  - SQLite through 3.32.0 has a segmentation fault in     sqlite3ExprCodeTarget in expr.c.(CVE-2020-13435)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

sqlite3 update :

Various security issues could be used by an attacker to cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code.

- CVE-2020-11655: SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled.

- CVE-2020-13434: SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.

- CVE-2020-13435: SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.

- CVE-2020-13630: ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.

- CVE-2020-13631: SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.

- CVE-2020-13632: ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4394-1 advisory.

    It was discovered that SQLite incorrectly handled certain corruped schemas. An attacker could possibly use     this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-8740)

    It was discovered that SQLite incorrectly handled certain SELECT statements. An attacker could possibly     use this issue to cause a denial of service. This issue was only addressed in Ubuntu 19.10.
    (CVE-2019-19603)

    It was discovered that SQLite incorrectly handled certain self-referential views. An attacker could     possibly use this issue to cause a denial of service. This issue was only addressed in Ubuntu 19.10.
    (CVE-2019-19645)

    Henry Liu discovered that SQLite incorrectly handled certain malformed window-function queries. An     attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 19.10     and Ubuntu 20.04 LTS. (CVE-2020-11655)

    It was discovered that SQLite incorrectly handled certain string operations. An attacker could use this     issue to cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2020-13434)

    It was discovered that SQLite incorrectly handled certain expressions. An attacker could use this issue to     cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue     only affected Ubuntu 19.10 and Ubuntu 20.04 LTS. (CVE-2020-13435)

    It was discovered that SQLite incorrectly handled certain fts3 queries. An attacker could use this issue     to cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2020-13630)

    It was discovered that SQLite incorrectly handled certain virtual table names. An attacker could possibly     use this issue to cause a denial of service. This issue was only addressed in Ubuntu 19.10 and Ubuntu     20.04 LTS. (CVE-2020-13631)

    It was discovered that SQLite incorrectly handled certain fts3 queries. An attacker could use this issue     to cause SQLite to crash, resulting in a denial of service, or possibly execute arbitrary code.
    (CVE-2020-13632)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It was discovered that there was a denial of service attack in the SQLite database, often embedded into other programs and servers.

In the event of a semantic error in an aggregate query, SQLite did not return early from the 'resetAccumulator()' function which would lead to a crash via a segmentation fault.

For Debian 8 'Jessie', this issue has been fixed in sqlite3 version 3.8.7.1-1+deb8u5.

We recommend that you upgrade your sqlite3 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the sqlite package has been released.

According to the version of the sqlite packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - SQLite through 3.31.1 allows attackers to cause a     denial of service (segmentation fault) via a malformed     window-function query because the AggInfo object's     initialization is mishandled.(CVE-2020-11655)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
177842	Nessus Network Monitor < 6.2.2 Multiple Vulnerabilities (TNS-2023-23)	Nessus	Misc.	critical
163770	Juniper Junos OS Multiple Vulnerabilities (JSA69705)	Nessus	Junos Local Security Checks	critical
152986	Tenable SecurityCenter < 5.19.0 Multiple Vulnerabilities (TNS-2021-14)	Nessus	Misc.	critical
148357	Photon OS 4.0: Mysql PHSA-2021-4.0-0007	Nessus	PhotonOS Local Security Checks	critical
138949	GLSA-202007-26 : SQLite: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
137800	EulerOS Virtualization for ARM 64 3.0.6.0 : sqlite (EulerOS-SA-2020-1693)	Nessus	Huawei Local Security Checks	high
137439	FreeBSD : several security issues in sqlite3 (c4ac9c79-ab37-11ea-8b5e-b42e99a1b9c3)	Nessus	FreeBSD Local Security Checks	high
137353	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS : SQLite vulnerabilities (USN-4394-1)	Nessus	Ubuntu Local Security Checks	high
136368	Debian DLA-2203-1 : sqlite3 security update	Nessus	Debian Local Security Checks	high
136037	Photon OS 1.0: Sqlite PHSA-2020-1.0-0289	Nessus	PhotonOS Local Security Checks	critical
135907	Photon OS 2.0: Sqlite PHSA-2020-2.0-0231	Nessus	PhotonOS Local Security Checks	critical
135778	Photon OS 3.0: Sqlite PHSA-2020-3.0-0081	Nessus	PhotonOS Local Security Checks	critical
135745	EulerOS 2.0 SP8 : sqlite (EulerOS-SA-2020-1512)	Nessus	Huawei Local Security Checks	high

Detections

Analytics

CVE-2020-11655

high

Tenable Plugins

critical

critical

critical

critical

critical

high

high

high

high

critical

critical

critical

high