Date: Thu, 6 Nov 2014 14:04:47 +0100 From: "Jason A. Donenfeld" <Jason@...c4.com> To: oss-security <oss-security@...ts.openwall.com> Subject: CVE Request: Qt Creator fails to verify SSH host key Hi folks, Qt Creator contains a hand-rolled SSH client, for remote debugging and deployment onto mobile devices and small Linux computers. In my experience with it, it's quite a slick library, actually. Unfortunately, they don't check host keys when connecting, which makes a man-in-the-middle attack trivial. It looks like this is something that occurred to them during development, but it was never written on time and the code has shipped without it: src/libs/ssh/sshconnection.cpp: // TODO: Mechanism for checking the host key. First connection to host: save, later: compare src/libs/ssh/sshexception_p.h: SSH_DISCONNECT_HOST_KEY_NOT_VERIFIABLE = 9, I reported this bug to the development team, alongside another bug involving cipher-suite compatibility with OpenSSH 6.7 (no CTR modes). They marked the latter as priority 1, and fixed it within 24 hours. The former, however, has received a bit more of a hesitant reaction. The most recent vendor feedback seems to indicate they're not super interested in implementing this. The bug report can be found here: https://bugreports.qt-project.org/browse/QTCREATORBUG-13339 So, I'm reporting it to this list, on the off-chance that I'm right and this should be considered a security vulnerability, in which case a CVE can track the status of the vendor response. Or, if the list decides this is actually no big deal, and host key checking isn't such an essential thing (?!), I'll close the bug report. Thanks, Jason
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ