Bug 708266 - VUL-0: Upcoming (yet) unknown multiple KDE input processing issue
VUL-0: Upcoming (yet) unknown multiple KDE input processing issue
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: General
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: E-mail List
E-mail List
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2011-07-26 07:26 UTC by Sebastian Krahmer
Modified: 2012-03-28 21:23 UTC (History)
2 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sebastian Krahmer 2011-07-26 07:26:19 UTC
Via OSS-sec:


Date: Mon, 25 Jul 2011 14:51:47 -0400
From: Jeff Mitchell


Hello,

We've been made aware of an input validation failure affecting multiple
KDE applications. (The details are not yet public as we're working on
the fixes.) We'd like a CVE for this.

The Arora and Rekonq web browsers are also vulnerable to the same attack
vector, and other Qt-based programs may be as well. We're working with
the Qt team to help enhance their documentation to warn developers to
take care sanitizing their inputs, but it's not actually a Qt flaw. So
we're a bit unsure how to proceed here. Do we get separate CVEs for
Arora and Rekonq? Do we lump both of those into the same CVE as the KDE
applications? I would think the former since other applications may be
found to be vulnerable down the line, but wanted to check.

(The Rekonq team has been made aware and are currently patching their
code; I'm in the process of trying to notify the Arora team.)

Thanks,
Jeff
Comment 1 Thomas Biege 2011-07-29 08:06:02 UTC
Re: [oss-security] CVE: Input validation failure affecting multiple KDE applications, as well as many other Qt-based applications
 Von: Jeff Mitchell <mitchell@kde.org>
 An: "Steven M. Christey" <coley@rcf-smtp.mitre.org>
 Kopie: oss-security@lists.openwall.com, KDE Security Team <security@kde.org>, security@qt.nokia.com, Tim Brown <timb@nth-dimension.org.uk>
 
On 07/27/2011 04:57 PM, Steven M. Christey wrote:
> 
> On Mon, 25 Jul 2011, Jeff Mitchell wrote:
> 
>> The Arora and Rekonq web browsers are also vulnerable to the same attack
>> vector, and other Qt-based programs may be as well. We're working with
>> the Qt team to help enhance their documentation to warn developers to
>> take care sanitizing their inputs, but it's not actually a Qt flaw. So
>> we're a bit unsure how to proceed here.
> 
> This sounds like a limitation of the Qt API, which can be avoided by
> programmers who are aware of the limitation.  Kind of like how strcpy()
> can be subject to buffer overflows, if the programmer isn't careful.
> Also happened with confusing return values from certain OpenSSL API
> functions a couple years ago.  (The PHP_SELF example is similar.)  So,
> this should probably get separate CVEs for each application/library that
> misuses the relevant function(s).

That sounds good. On the KDE side, this is kdelibs, Kleopatra, and
Konqueror.

> If Qt itself contains misuse of its own functions - which happens
> sometimes (CVE-2008-5077 for OpenSSL) - then Qt might need its own CVE,
> too.

As far as I'm aware Qt itself is not affected, but we've not done an
exhaustive analysis.

Thanks,
Jeff
Comment 2 Thomas Biege 2011-08-12 16:35:13 UTC
please ignore, just adjusting priority
Comment 3 Marcus Meissner 2012-03-28 21:23:58 UTC
i think we fixed this (SSL certification stuff)