oss-sec mailing list archives
CVE Request: Qt Creator fails to verify SSH host key
From: "Jason A. Donenfeld" <Jason () zx2c4 com>
Date: Thu, 6 Nov 2014 14:04:47 +0100
Hi folks, Qt Creator contains a hand-rolled SSH client, for remote debugging and deployment onto mobile devices and small Linux computers. In my experience with it, it's quite a slick library, actually. Unfortunately, they don't check host keys when connecting, which makes a man-in-the-middle attack trivial. It looks like this is something that occurred to them during development, but it was never written on time and the code has shipped without it: src/libs/ssh/sshconnection.cpp: // TODO: Mechanism for checking the host key. First connection to host: save, later: compare src/libs/ssh/sshexception_p.h: SSH_DISCONNECT_HOST_KEY_NOT_VERIFIABLE = 9, I reported this bug to the development team, alongside another bug involving cipher-suite compatibility with OpenSSH 6.7 (no CTR modes). They marked the latter as priority 1, and fixed it within 24 hours. The former, however, has received a bit more of a hesitant reaction. The most recent vendor feedback seems to indicate they're not super interested in implementing this. The bug report can be found here: https://bugreports.qt-project.org/browse/QTCREATORBUG-13339 So, I'm reporting it to this list, on the off-chance that I'm right and this should be considered a security vulnerability, in which case a CVE can track the status of the vendor response. Or, if the list decides this is actually no big deal, and host key checking isn't such an essential thing (?!), I'll close the bug report. Thanks, Jason
Current thread:
- CVE Request: Qt Creator fails to verify SSH host key Jason A. Donenfeld (Nov 06)
- Re: CVE Request: Qt Creator fails to verify SSH host key Michael Samuel (Nov 06)
- Re: CVE Request: Qt Creator fails to verify SSH host key Jason A. Donenfeld (Nov 06)
- Re: CVE Request: Qt Creator fails to verify SSH host key Jason A. Donenfeld (Nov 06)
- Re: CVE Request: Qt Creator fails to verify SSH host key Jason A. Donenfeld (Nov 06)
- Re: CVE Request: Qt Creator fails to verify SSH host key cve-assign (Nov 10)
- Re: CVE Request: Qt Creator fails to verify SSH host key Jason A. Donenfeld (Nov 10)
- Re: CVE Request: Qt Creator fails to verify SSH host key Michael Samuel (Nov 06)