PT-2012-1321 · Qt+2 · Qt+2

Thiago Macieira · Published 2012-06-19 · Updated 2021-06-16 · CVE-2010-5076

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Qt versions prior to 4.7.0-rc1

Description The issue allows man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority. This is possible because QSslSocket in Qt recognizes a wildcard IP address in the subject's Common Name field of an X.509 certificate.

Recommendations For Qt versions prior to 4.7.0-rc1, update to version 4.7.0-rc1 or later to resolve the issue. As a temporary workaround, consider restricting the use of QSslSocket until a patch is available. Avoid using QSslSocket with certificates that contain wildcard IP addresses in the Common Name field until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CESA-2012_0880

CVE-2010-5076

RHSA-2012:0880

RHSA-2012_0880

Affected Products

Centos

Qt

Red Hat

References · 46

• 🔥 http://qt.gitorious.org/qt/qt/commit/5f6018564668d368f75e431c4cdac88d7421cff0 · Exploit
• http://secunia.com/advisories/41236 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-05402 · Security Note
• https://bdu.fstec.ru/vul/2015-04540 · Security Note
• https://bdu.fstec.ru/vul/2015-04547 · Security Note
• https://bdu.fstec.ru/vul/2015-04541 · Security Note
• https://bdu.fstec.ru/vul/2015-04538 · Security Note
• https://bdu.fstec.ru/vul/2015-04546 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2010-5076 · Security Note
• http://qt.gitorious.org/qt/qt/commit/846f1b44eea4bb34d080d055badb40a4a13d369e · Patch
• https://bdu.fstec.ru/vul/2015-05397 · Security Note
• https://bdu.fstec.ru/vul/2015-05396 · Security Note
• https://bdu.fstec.ru/vul/2015-04534 · Security Note
• https://bdu.fstec.ru/vul/2015-04543 · Security Note
• http://secunia.com/advisories/49895 · Vendor Advisory