[CVE-2013-0254] Qt Project Security Advisory: System V shared memory segments created world-writeable

Debian Bug report logs - #699870
[CVE-2013-0254] Qt Project Security Advisory: System V shared memory segments created world-writeable

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Luciano Bello <luciano@debian.org>

To: submit@bugs.debian.org

Subject: CVE-2013-0254] Qt Project Security Advisory: System V shared memory segments created world-writeable

Date: Wed, 6 Feb 2013 03:18:07 +0100

Package: qt4-x11
Severity: important
Tags: security patch
Justification: user security hole

Hi Qt/KDE Maintainers,
     This vulnerability had been reported against qt4-x11:
 http://permalink.gmane.org/gmane.comp.lib.qt.devel/9759
     The patch for 4.8 (which is in testing and sid) is available. For 4.6 looks 
quite easy to port. Can build and test a patch for stable in order to release a 
DSA?

Thanks, luciano

Message #10 received at 699870-done@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Luciano Bello <luciano@debian.org>, 699870-done@bugs.debian.org

Subject: Re: Bug#699870: CVE-2013-0254] Qt Project Security Advisory: System V shared memory segments created world-writeable

Date: Wed, 6 Feb 2013 08:46:24 +0100

Source: qt4-x11
Source-Version: 4:4.8.2+dfsg-11

On Wed, Feb 06, 2013 at 03:18:07AM +0100, Luciano Bello wrote:
> Package: qt4-x11
> Severity: important
> Tags: security patch
> Justification: user security hole
> 
> Hi Qt/KDE Maintainers,
>      This vulnerability had been reported against qt4-x11:
>  http://permalink.gmane.org/gmane.comp.lib.qt.devel/9759
>      The patch for 4.8 (which is in testing and sid) is available. For 4.6 looks 
> quite easy to port. Can build and test a patch for stable in order to release a 
> DSA?

For unstable this was fixed in 4:4.8.2+dfsg-11. Closing manually as
changelog entry did not contain the bug closer.

Regards,
Salvatore

Message #25 received at 699870@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Luciano Bello <luciano@debian.org>, 699870@bugs.debian.org

Subject: Re: Bug#699870: [CVE-2013-0254] Qt Project Security Advisory: System V shared memory segments created world-writeable

Date: Sun, 18 Aug 2013 21:50:19 +0200

Hi Qt/KDE Maintainers,

On Wed, Feb 06, 2013 at 03:18:07AM +0100, Luciano Bello wrote:
> Package: qt4-x11
> Severity: important
> Tags: security patch
> Justification: user security hole
> 
> Hi Qt/KDE Maintainers,
>      This vulnerability had been reported against qt4-x11:
>  http://permalink.gmane.org/gmane.comp.lib.qt.devel/9759
>      The patch for 4.8 (which is in testing and sid) is available. For 4.6 looks 
> quite easy to port. Can build and test a patch for stable in order to release a 
> DSA?

Did you had a chance to look at this already? The patch for 4.7 is at
[1].

 [1] http://qt.gitorious.org/qt/qt/commit/57756e72adf2081137b97f0e689dd16c770d10b1

Regards,
Salvatore

Message #30 received at 699870@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Luciano Bello <luciano@debian.org>, 699870@bugs.debian.org

Subject: Re: Bug#699870: [CVE-2013-0254] Qt Project Security Advisory: System V shared memory segments created world-writeable

Date: Sun, 18 Aug 2013 22:11:39 +0200

[Message part 1 (text/plain, inline)]

Control: tags -1 + patch

Hi Qt/KDE Maintainers,

Attached is a (yet at all untested) patch based on the commits for the
4.7 branch [1].

 [1] http://qt.gitorious.org/qt/qt/commit/57756e72adf2081137b97f0e689dd16c770d10b1

Regards,
Salvatore

[97_CVE-2013-0254.diff (text/x-diff, attachment)]

Message #35 received at 699870@bugs.debian.org (full text, mbox, reply):

From: "Lisandro Damián Nicanor Pérez Meyer" <perezmeyer@gmail.com>

To: Salvatore Bonaccorso <carnil@debian.org>, 699870@bugs.debian.org

Cc: Luciano Bello <luciano@debian.org>

Subject: Re: Bug#699870: [CVE-2013-0254] Qt Project Security Advisory: System V shared memory segments created world-writeable

Date: Sun, 18 Aug 2013 21:37:06 -0300

[Message part 1 (text/plain, inline)]

On Sunday 18 August 2013 22:11:39 Salvatore Bonaccorso wrote:
> Control: tags -1 + patch
> 
> Hi Qt/KDE Maintainers,
> 
> Attached is a (yet at all untested) patch based on the commits for the
> 4.7 branch [1].
> 
>  [1]
> http://qt.gitorious.org/qt/qt/commit/57756e72adf2081137b97f0e689dd16c770d10
> b1

This is from the top of my head: IIRC, this got into Wheezy and I was working 
with a fix for Squeeze which also included some blacklisting stuff that was 
objected by a reason I don't quite remember now.

Some time later, we released Wheezy.

I currently don't have a Squeeze installation at hand nor the time to look at 
it. I don't know the if anyone of the rest of the team has some spare time to 
look into this.

Kinds regards, Lisandro.

-- 
Un viejo proverbio de El.Machi dice que la memoria es como
las papas fritas... ¡nunca sobran!

Lisandro Damián Nicanor Pérez Meyer
http://perezmeyer.com.ar/
http://perezmeyer.blogspot.com/

[signature.asc (application/pgp-signature, inline)]

Message #40 received at 699870@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Lisandro Damián Nicanor Pérez Meyer <perezmeyer@gmail.com>

Cc: 699870@bugs.debian.org, Luciano Bello <luciano@debian.org>, team@security.debian.org

Subject: Re: Bug#699870: [CVE-2013-0254] Qt Project Security Advisory: System V shared memory segments created world-writeable

Date: Thu, 5 Sep 2013 22:41:36 +0200

Hi Lisandro

[Really apologies not having replied earlier]

On Sun, Aug 18, 2013 at 09:37:06PM -0300, Lisandro Damián Nicanor Pérez Meyer wrote:
> On Sunday 18 August 2013 22:11:39 Salvatore Bonaccorso wrote:
> > Control: tags -1 + patch
> > 
> > Hi Qt/KDE Maintainers,
> > 
> > Attached is a (yet at all untested) patch based on the commits for the
> > 4.7 branch [1].
> > 
> >  [1]
> > http://qt.gitorious.org/qt/qt/commit/57756e72adf2081137b97f0e689dd16c770d10
> > b1
> 
> This is from the top of my head: IIRC, this got into Wheezy and I was working 
> with a fix for Squeeze which also included some blacklisting stuff that was 
> objected by a reason I don't quite remember now.
> 
> Some time later, we released Wheezy.
> 
> I currently don't have a Squeeze installation at hand nor the time to look at 
> it. I don't know the if anyone of the rest of the team has some spare time to 
> look into this.

... probably the following: Sune Vuorela pointed to #700530[1]. If the
above patches are applied, this introduces the problem mentioned on
kfreebsd-i386 and kfreebsd-amd64.

Regards,
Salvatore

Message #45 received at 699870@bugs.debian.org (full text, mbox, reply):

From: Lisandro Damián Nicanor Pérez Meyer <perezmeyer@gmail.com>

To: Salvatore Bonaccorso <carnil@debian.org>

Cc: 699870@bugs.debian.org, Luciano Bello <luciano@debian.org>, team@security.debian.org

Subject: Re: Bug#699870: [CVE-2013-0254] Qt Project Security Advisory: System V shared memory segments created world-writeable

Date: Mon, 09 Sep 2013 23:16:36 -0300

[Message part 1 (text/plain, inline)]

On Thursday 05 September 2013 22:41:36 Salvatore Bonaccorso wrote:
> Hi Lisandro
> 
> [Really apologies not having replied earlier]

Well, you are not the only one :) My apologies too.

[snip]

> > I currently don't have a Squeeze installation at hand nor the time to look
> > at it. I don't know the if anyone of the rest of the team has some spare
> > time to look into this.
> 
> ... probably the following: Sune Vuorela pointed to #700530[1]. If the
> above patches are applied, this introduces the problem mentioned on
> kfreebsd-i386 and kfreebsd-amd64.

Indeed, that was *another* reason :) I've already forgot that one. Yes, 
applying the patch to fix the CVS will surely trigger an RC bug for kbsd* :-(

The other reason was [0]. Luciano correctly pointed out that it would be much 
better to centralize that blacklisting stuff, and while I agree with the idea 
behind it, this is something which has to be implemented upstream for us to 
accept it, for example, making upstream use 3rd party info for this cases.

This will hardly happen in Qt4 because it's already on maintainance mode.

In the case of Qt5 the code seems to exists [1] so maybe there is a chance.

I saddly lack the security [concepts software] knowledge and time to do this. 
But if any of you want to try, do not heasitate to present patches upstream.

Kinds regards, Lisandro.

[0] <http://patch-tracker.debian.org/patch/series/view/qt4-x11/4:4.8.2+dfsg-11/SSL-certificates-blacklist-mis-issued-Turktrust-cert.patch>
[1] <http://sources.debian.net/src/qtbase-opensource-src/5.1.1+dfsg-2/src/network/ssl/qsslcertificate.cpp?hl=1216#L1174>

-- 
Los errores ortográficos y de redacción fueron insertados con la única
intención de testear sus conocimientos de la lengua castellana.

Lisandro Damián Nicanor Pérez Meyer
http://perezmeyer.com.ar/
http://perezmeyer.blogspot.com/

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.