qtcreator: CVE-2010-3374: insecure library loading

Debian Bug report logs - #598300
qtcreator: CVE-2010-3374: insecure library loading

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Raphael Geissert <geissert@debian.org>

To: submit@bugs.debian.org

Subject: qtcreator: CVE-2010-3374: insecure library loading

Date: Tue, 28 Sep 2010 04:22:37 +0000

Package: qtcreator
Version: 1.3.1-2
Severity: grave
Tags: security
User: team@security.debian.org
Usertags: ldpath

Hello,

During a review of the Debian archive, I've found your package to
contain a script that can be abused by an attacker to execute arbitrary
code.

The vulnerability is introduced by an insecure change to
LD_LIBRARY_PATH, and environment variable used by ld.so(8) to look for
libraries on a directory other than the standard paths.

Vulnerable code follows:

/usr/bin/qtcreator line 34:
LD_LIBRARY_PATH="${libdir}/qtcreator:${LD_LIBRARY_PATH}"

When there's an empty item on the colon-separated list of
LD_LIBRARY_PATH, ld.so treats it as '.' (i.e. CWD/$PWD.)
If the given script is executed from a directory where a potential,
local, attacker can write files to, there's a chance to exploit this
bug.

This vulnerability has been assigned the CVE id CVE-2010-3374. Please make sure
you mention it when fixing. Upstream is already aware of this issue.

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3374
[1] http://security-tracker.debian.org/tracker/CVE-2010-3374

Sincerely,
Raphael Geissert

Message #12 received at 598300-close@bugs.debian.org (full text, mbox, reply):

From: Fathi Boudra <fabo@debian.org>

To: 598300-close@bugs.debian.org

Subject: Bug#598300: fixed in qtcreator 1.3.1-3

Date: Wed, 06 Oct 2010 11:47:39 +0000

Source: qtcreator
Source-Version: 1.3.1-3

We believe that the bug you reported is fixed in the latest version of
qtcreator, which is due to be installed in the Debian FTP archive:

qtcreator-doc_1.3.1-3_all.deb
  to main/q/qtcreator/qtcreator-doc_1.3.1-3_all.deb
qtcreator_1.3.1-3.diff.gz
  to main/q/qtcreator/qtcreator_1.3.1-3.diff.gz
qtcreator_1.3.1-3.dsc
  to main/q/qtcreator/qtcreator_1.3.1-3.dsc
qtcreator_1.3.1-3_amd64.deb
  to main/q/qtcreator/qtcreator_1.3.1-3_amd64.deb



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 598300@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Fathi Boudra <fabo@debian.org> (supplier of updated qtcreator package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.8
Date: Wed, 06 Oct 2010 14:12:22 +0300
Source: qtcreator
Binary: qtcreator qtcreator-doc
Architecture: source all amd64
Version: 1.3.1-3
Distribution: unstable
Urgency: low
Maintainer: Debian Qt/KDE Maintainers <debian-qt-kde@lists.debian.org>
Changed-By: Fathi Boudra <fabo@debian.org>
Description: 
 qtcreator  - lightweight integrated development environment (IDE) for Qt
 qtcreator-doc - documentation for Qt Creator IDE
Closes: 598300
Changes: 
 qtcreator (1.3.1-3) unstable; urgency=low
 .
   * CVE-2010-3374: fix insecure library loading. (Closes: #598300)
Checksums-Sha1: 
 dd6ff5a63b6f9661b0ac084df8922ae2938cadc6 1466 qtcreator_1.3.1-3.dsc
 631fe74b88206d36c67f02f7e549dfc8dbcf2a87 9601 qtcreator_1.3.1-3.diff.gz
 204fc7feb665cb12117c645a88ce538b747fa930 5596048 qtcreator-doc_1.3.1-3_all.deb
 1bf59b6cc9c5a69fbd259f09c2d21310ac99815b 5960288 qtcreator_1.3.1-3_amd64.deb
Checksums-Sha256: 
 3380f43ac80cb13a47126fef7fc67ddf88ad5e7b88ec97266a37418c2eb6cb44 1466 qtcreator_1.3.1-3.dsc
 c41d60651ba90b9db745a4e6fb587568cbc4381cab3ea7a6d034f37d8866e112 9601 qtcreator_1.3.1-3.diff.gz
 cfbd4cd0b525d69aaf273eedd39143f640c29026278b6a527d19b4e3d4bb6228 5596048 qtcreator-doc_1.3.1-3_all.deb
 01229c1bd3f876e150a0b29d726fa16a10888d22aee1caa01545a7c5164b6d0e 5960288 qtcreator_1.3.1-3_amd64.deb
Files: 
 77996660143efa86e2328817555eb7d2 1466 devel optional qtcreator_1.3.1-3.dsc
 5ac823180494de4fa1f3813f66428b02 9601 devel optional qtcreator_1.3.1-3.diff.gz
 e3bdcfa70c1dc4eaff97dc565fc831c5 5596048 doc optional qtcreator-doc_1.3.1-3_all.deb
 8ee359d628004668a2878f32c306d06b 5960288 devel optional qtcreator_1.3.1-3_amd64.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iJwEAQECAAYFAkysXH0ACgkQjPU19mqlcvcdIwQAuYP7X002BvQElDzNKleG4twp
Hpm/oricfw9e5SL0Je/IC/YG9PpuLGJJZljXrEC+78oornMXwD7fnvB0yY90wMI5
aq89f+9cgCUbgFzxnFPtidjVlBChcUltuXDu7n3MO5EWId9zvZxCYg3L8fzQPiJn
JtmKUZu42aMfo28fvqg=
=CENt
-----END PGP SIGNATURE-----

Send a report that this bug log contains spam.