CRSA-2015-0006.yaml

title: 'OpenDaylight SQLite memory corruption leading to DoS and possible code execution'

description: 'The Helium release of AAA uses SQL statements assembled using string concatenation of user-supplied variables. This theoretically exposes an SQL injection vulnerability, but testing has revealed no cases that could cross a trust boundary and be useful to an attacker. However, as a result of allowing users to directly manipulate SQL statements, AAA exposes two underlying memory corruption vulnerabilities in SQLite (CVE-2015-3414 and CVE-2015-3416). Another vulnerability in SQLite was also reported (CVE-2015-3415), but AAA does not expose this vulnerability, because it relies on injection of DDL and AAA only allows an attacker to inject DML.'

references: 
  - http://seclists.org/fulldisclosure/2015/Apr/31
  - https://wiki.opendaylight.org/view/Security_Advisories

affected-products:

  - product: CloudRouter
    version:
      - id: 1.0-beta
        component: opendaylight-helium
        issues:
          - 91
        patches:
          - https://git.opendaylight.org/gerrit/#/c/22051/

vulnerabilities:

  - cve-id: CVE-2015-3414
    cloudrouter-security-issue: 6
    impact-assessment:
      source: 'IIX Product Security'
      rating: moderate
      assessment:
        type: CVSS2
        score: 3.7
        detail: AV:L/AC:H/Au:N/C:P/I:P/A:P
    classification:
      source: 'IIX Product Security'
      type: CWE
      detail: TODO
  - cve-id: CVE-2015-3416
    cloudrouter-security-issue: 6
    impact-assessment:
      source: 'IIX Product Security'
      rating: moderate
      assessment:
        type: CVSS2
        score: 3.7
        detail: AV:L/AC:H/Au:N/C:P/I:P/A:P
    classification:
      source: 'IIX Product Security'
      type: CWE
      detail: TODO

reporters:

  - name: 'Ryan Goulding'
    reported:
      - CVE-2015-3414
      - CVE-2015-3416