On 30/01/20 11:30, Dominik Holland wrote:
Doesn't the first fix break the standard way of deploying plugins on
windows ? I'm also not sure why this shouldn't affect windows ?
Most applications using Qt on windows just deploy their plugins in the
folder next to the binary. Same like all dlls needed for the binary...
I see how this fixes the security problem when Qt comes from the system
and you cannot write to that location, but for all other cases it won't
change anything ?
Sorry if i missed something very obvious
$PWD is not the same as the binary dir (QCoreApplication::applicationDirPath)
The later is still searched while looking for plugin. (so that covers the case
where plugin is in the folder next to the binary)
But I am also not sure why Windows is not affected.
--
Olivier
Am 30.01.20 um 02:18 schrieb Thiago Macieira:
The Qt security team was made aware of two issues affecting the currently-
released versions of Qt that could lead to loading of untrusted plugins, which
can execute code immediately upon loading. We have assigned two IDs for them.
The patches fixing those issues are linked to below.
Issue 1) CVE-2020-0569
Score: 7.3 (High) - CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
* Vendor: Qt Project
* Product: Qt
* Versions affected: 5.0.0 to 5.13.2
* Versions fixed: 5.14.0 (already released), 5.12.7, 5.9.10 (future)
* Issue: local attack, loading and execution of untrusted code
* Scope: class QPluginLoader (qtbase/src/corelib/plugin/qpluginloader.cpp)
* Description:
QPluginLoader in Qt versions 5.0.0 through 5.13.2 would search for certain
plugins first on the current working directory of the application, which
allows an attacker that can place files in the file system and influence the
working directory of Qt-based applications to load and execute malicious code.
This issue was verified on macOS and Linux and probably affects all other Unix
operating systems. This issue does not affect Windows.
Patches:
- 5.6.0 through 5.13.2: https://code.qt.io/cgit/qt/qtbase.git/commit/?
id=bf131e8d2181b3404f5293546ed390999f760404
- 5.0.0 through 5.5.1: https://code.qt.io/cgit/qt/qtbase.git/commit/?
id=5c4234ed958130d655df8197129806f687d4df0d
Issue 2) CVE-2020-0570
Score: 7.3 (High) - CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
* Vendor: Qt Project
* Product: Qt
* Versions affected: 5.12.0 through 5.14.0
* Versions fixed: 5.14.1 (released), 5.12.7, 5.9.10 (future)
* Issue: local attack, loading and execution of untrusted code
* Scope: class QLibrary (qtbase/src/corelib/plugin)
* Reference: https://bugreports.qt.io/browse/QTBUG-81272
* Description:
QLibrary in Qt versions 5.12.0 through 5.14.0, on certain x86 machines, would
search for certain libraries and plugins relative to current working directory
of the application, which allows an attacker that can place files in the file
system and influence the working directory of Qt-based applications to load
and execute malicious code. This issue was verified on Linux and probably
affects all Unix operating systems, other than macOS (Darwin). This issue does
not affect Windows.
Patch: https://code.qt.io/cgit/qt/qtbase.git/commit/?
id=e6f1fde24f77f63fb16b2df239f82a89d2bf05dd
_______________________________________________
Development mailing list
[email protected]
https://lists.qt-project.org/listinfo/development
_______________________________________________
Development mailing list
[email protected]
https://lists.qt-project.org/listinfo/development
