[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.64.1107271651010.17118@faron.mitre.org>
Date: Wed, 27 Jul 2011 16:57:32 -0400 (EDT)
From: "Steven M. Christey" <coley@...-smtp.mitre.org>
To: oss-security@...ts.openwall.com
cc: KDE Security Team <security@....org>, security@...nokia.com,
Tim Brown <timb@...-dimension.org.uk>
Subject: Re: CVE: Input validation failure affecting multiple
KDE applications, as well as many other Qt-based applications
On Mon, 25 Jul 2011, Jeff Mitchell wrote:
> The Arora and Rekonq web browsers are also vulnerable to the same attack
> vector, and other Qt-based programs may be as well. We're working with
> the Qt team to help enhance their documentation to warn developers to
> take care sanitizing their inputs, but it's not actually a Qt flaw. So
> we're a bit unsure how to proceed here.
This sounds like a limitation of the Qt API, which can be avoided by
programmers who are aware of the limitation. Kind of like how strcpy()
can be subject to buffer overflows, *if* the programmer isn't careful.
Also happened with confusing return values from certain OpenSSL API
functions a couple years ago. (The PHP_SELF example is similar.) So,
this should probably get separate CVEs for each application/library that
misuses the relevant function(s).
If Qt itself contains misuse of its own functions - which happens
sometimes (CVE-2008-5077 for OpenSSL) - then Qt might need its own CVE,
too.
- Steve
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
