oss-security - CVE Request: Qt Creator fails to verify SSH host key

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Thu, 6 Nov 2014 14:04:47 +0100
From: "Jason A. Donenfeld" <Jason@...c4.com>
To: oss-security <oss-security@...ts.openwall.com>
Subject: CVE Request: Qt Creator fails to verify SSH host key

Hi folks,

Qt Creator contains a hand-rolled SSH client, for remote debugging and
deployment onto mobile devices and small Linux computers. In my experience
with it, it's quite a slick library, actually. Unfortunately, they don't
check host keys when connecting, which makes a man-in-the-middle attack
trivial.

It looks like this is something that occurred to them during development,
but it was never written on time and the code has shipped without it:

src/libs/ssh/sshconnection.cpp:
    // TODO: Mechanism for checking the host key. First connection to host:
save, later: compare
src/libs/ssh/sshexception_p.h:
    SSH_DISCONNECT_HOST_KEY_NOT_VERIFIABLE = 9,

I reported this bug to the development team, alongside another bug
involving cipher-suite compatibility with OpenSSH 6.7 (no CTR modes). They
marked the latter as priority 1, and fixed it within 24 hours. The former,
however, has received a bit more of a hesitant reaction. The most recent
vendor feedback seems to indicate they're not super interested in
implementing this.

The bug report can be found here:
https://bugreports.qt-project.org/browse/QTCREATORBUG-13339

So, I'm reporting it to this list, on the off-chance that I'm right and
this should be considered a security vulnerability, in which case a CVE can
track the status of the vendor response. Or, if the list decides this is
actually no big deal, and host key checking isn't such an essential thing
(?!), I'll close the bug report.

Thanks,
Jason

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.