Bug 845511 - (CVE-2013-4422) VUL-0: CVE-2013-4422: quassel: sql injection
VUL-0: CVE-2013-4422: quassel: sql injection
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
Other Other
: P3 - Medium : Normal
: ---
Assigned To: E-mail List
Security Team bot
Depends on: CVE-2015-3427
  Show dependency treegraph
Reported: 2013-10-11 12:07 UTC by Marcus Meissner
Modified: 2015-04-27 11:10 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2013-10-11 12:07:56 UTC
via oss-sec

From: Bas Pape <baspape@gmail.com>
Date: Wed, 9 Oct 2013 18:48:01 +0200
Subject: [oss-security] CVE Request - Quassel IRC SQL injection

Hi all,

Please assign a CVE to the following issue:
Quassel IRC is vulnerable to SQL injection on all current versions
(0.9.0 being the latest at the time of writing), if used with Qt 4.8.5
(the vulnerability is caused by a change in its postgres driver[1,2])
and PostgreSQL 8.2 or later with standard_conforming_strings enabled
(which is the default in those versions). The vulnerability allows
anyone to trick the core into executing SQL queries, which includes
cascade deleting the entire database. It is tracked upstream in bug
#1244 [3]. It was firstly noticed by due to minor issues with
migration to postgres and problems with certain messages, a simple
test with an unmodified installation of postgres and quassel showed
that it was indeed possible to drop tables.

No upstream fix is available at this time, although the below patch
does fix the current issue.

Bas Pape (Tucos)

[1] https://qt.gitorious.org/qt/qtbase/commit/e3c5351d06ce8a12f035cd0627356bc64d8c334a
[2] https://bugreports.qt-project.org/browse/QTBUG-30076
[3] http://bugs.quassel-irc.org/issues/1244
commit 7c64ed0d05718d907770d11a38436aa4ed65f2bb
Author: Bas Pape <baspape@gmail.com>
Date:   Mon Oct 7 19:51:52 2013 +0200

    Detect the need for standard_conforming_strings.

diff --git a/src/core/postgresqlstorage.cpp b/src/core/postgresqlstorage.cpp
index 3965704..70bf894 100644
--- a/src/core/postgresqlstorage.cpp
+++ b/src/core/postgresqlstorage.cpp
@@ -101,6 +101,15 @@ void PostgreSqlStorage::initDbSession(QSqlDatabase &db)
     // this blows... but unfortunately Qt's PG driver forces us to this...
     db.exec("set standard_conforming_strings = off");
     db.exec("set escape_string_warning = off");
+    // Fortunately things can always blow more. Refer to the commit message for
+    // the juicy details, tread lightly.
+    // First standard_conforming_strings are turned off, because
that's what used
+    // to be necessary, here the actual behaviour is tested.
+    QSqlQuery query = db.exec("SELECT '\\\\' x");
+    if (query.first())
+        if (query.value(0).toString() == "\\")
+            db.exec("set standard_conforming_strings = on");
Comment 1 Swamp Workflow Management 2013-10-11 22:00:24 UTC
bugbot adjusting priority
Comment 2 Marcus Meissner 2013-10-14 11:44:22 UTC
(from reporter)

For completeness sake, upstream fixed it [1] and announced a new
release (0.9.1 [2]).

[1] https://github.com/quassel/quassel/commit/aa1008be162cb27da938cce93ba533f54d228869
[2] http://quassel-irc.org/node/120
Comment 3 Tomáš Chvátal 2013-10-14 12:37:33 UTC
Hey, I am not the maintainer ;-)

Anyway somebody bumped it in KDE:Distro:Factory so it should probably be submitted to maintenance channels and factory.


As I was bumping it for this bug and it was changed by community member in meantime I at least moved it from init script to unit file to not feel like doing nothing :)

Comment 4 Bernhard Wiedemann 2013-10-14 13:00:24 UTC
This is an autogenerated message for OBS integration:
This bug (845511) was mentioned in
https://build.opensuse.org/request/show/203227 Factory / quassel
Comment 5 Antonio Larrosa 2013-12-13 08:23:43 UTC
Both openSUSE 13.1 and Factory contain quassel >= 0.9.1 where this bug is fixed, so I'm changing the state to resolved / upstream