Re: CVE Request: KDE Pim

[Kurt Seifried <kseifried () redhat com>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 07/17/2012 02:18 AM, laurent Montel wrote:
> Le lundi 16 juillet 2012 11:47:59 Vincent Danen a écrit :
> > * [2012-07-13 10:41:33 -0600] Kurt Seifried wrote:
> > > On 07/13/2012 06:25 AM, Marc Deslauriers wrote:
> > > > Hello,
> > > >
> > > > Could a CVE please be assigned to the following issue:
> > > >
> > > > Javascript and external images were being loaded while
> > > > rendering HTML email in kmail. The downloaded Javascript was
> > > > then being interpreted.
> > > >
> > > > See:
> > > >
> > > > https://projects.kde.org/projects/kde/kdepim/repository/revisions/dbb2f72
f4745e00f53031965a9c10b2d6862bd54>>
> > > > https://bugs.launchpad.net/ubuntu/+source/kdepim/+bug/1022690
Thanks,
> > > > Marc.
> > >
> > > This seems like a security hardening issue to me, but I'm not a
> > > KDE person so did kdepim advertise itself as not executing
> > > JavaScript/etc?
> >
> > Doing some digging, it looks like this was introduced in kdepim
> > 4.4, and would not affect earlier versions.  Can anyone confirm
> > this?
>
> No it was added in 4.6 or 4.7 when we ported to akonadi2 In 4.4 it
> didn't use *WebKit*
>
> and it didn't use same code : it used DOM::
>
> '  try { // Create a DOM Document from the HTML source 
> DOM::HTMLDocument doc; doc.open(); doc.write( htmlSource ); 
> doc.close();
>
> mIsQuotedLine = false; mIsFirstTextNodeInLine = true; processNode(
> doc.documentElement() ); return doc.toString().string(); } '
>
> So for me it's just kmail > 4.6 (we released an old 4.6-akonadi)
>
> not necessary to try to fix in 4.4
>
> I CC David if he has more infos.
>
> I hope that it helps.
>
> Security problem is that we allows to use javascript. In 4.4 we
> don't have it.
>
>
>
> Regards.
>
>
>
> > I'm cc'ing Laurent Montel who made the commit, and who should be
> > able to shed some light as to when the vulnerability was
> > introduced, and also answer Kurt's question above.
> >
> > Laurent, any information you can provide would be appreciated.
> >
> > -- Vincent Danen / Red Hat Security Response Team

This one is a gray area however based on my understanding of the
following:

The rendering engine/etc used by KDE Pim didn't support JavaScript
Things changed and JavaScript support was introduced
The devels realize this, and quickly move to disable JavaScript.

It seems like JavaScript was never meant to be supported in KDE Pim,
so in light of that I'm going to assign this a CVE as JavaScript
introduces a significant number of security issues and also violated
the principle of least surprise.

Please use CVE-2012-3413 for this issue.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993



-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQIcBAEBAgAGBQJQBb7/AAoJEBYNRVNeJnmTcJkP+gIW8N0N9KitiRPNUY5pNeqs
J44di4JuUITVStptpN00+ZcV/bnySSLgfxEMHJwKRv3eQOk+CpcvaZqJLgEDXE+V
ymY0k0UZS6vxBCu+NpqKk3EBHlNHoZHcyu+6QzDXhUDB+VdBjuze5oBkN5dlh923
Pin14Oh1wFvlBH7RuCHdtiwooBGdsJ1nIS+3s/FdA8aUbnCdPefp6PXGYCpXRO/O
7QAACltjdFGuzMKybWhqO6xtZcb7VAqYlqV4Bur+BKN8hDvr79LzpoTyscnwrZZA
hFBD3T+R9NUTZHei8wkNkm9hPUntcFRJeafJjMupRcuiZAeJq/bOnYeCs+dLOFkn
VkmcAxYlWqBCosAXD17tbTaKWOF/2Rg8C8AlmlMegjkOAoLf8vTkjMgdwf0T57a2
7BW8PceNW+hOPi+fM6Tn2HbLNDdkdo+dSlelvw1mH62v21y/2aB99qsADtwy0g5o
mr6Q1w+bU0vg71PcpLzUDupXlFwhJZDVm7/uPqIn8fbOxiNCaSPvYg6sw30gUxXl
G4dJLGKynwdQE1tYZOmab40N6jrTv4XUpc59ISNOi08HUSG5ZU6JQ6DV8BJ9PKvU
rEJsizRrOpM/2Lz3NcYWG15r1IzedJ4m6d8H45MCoCZQ0ojvJwcOErStI6UGwXJl
BPomIYD3PlFMbTwj2MjH
=AYwS
-----END PGP SIGNATURE-----