Vulnerabilities > CVE-2020-0570 - Untrusted Search Path vulnerability in multiple products

047910
CVSS 7.3 - HIGH
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
local
low complexity
qt
redhat
CWE-426
nessus
NVD
Published: 2020-09-14
Updated: 2021-09-21

Summary

Uncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an authenticated user to potentially enable elevation of privilege via local access.

Vulnerable Configurations

Part Description Count
Application
Qt
261
OS
Redhat
2

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Leveraging/Manipulating Configuration File Search Paths
    This attack loads a malicious resource into a program's standard path used to bootstrap and/or provide contextual information for a program like a path variable or classpath. J2EE applications and other component based applications that are built from multiple binaries can have very long list of dependencies to execute. If one of these libraries and/or references is controllable by the attacker then application controls can be circumvented by the attacker. A standard UNIX path looks similar to this If the attacker modifies the path variable to point to a locale that includes malicious resources then the user unwittingly can execute commands on the attackers' behalf: This is a form of usurping control of the program and the attack can be done on the classpath, database resources, or any other resources built from compound parts. At runtime detection and blocking of this attack is nearly impossible, because the configuration allows execution.

Nessus

  • NASL familyDebian Local Security Checks
    NASL idDEBIAN_DSA-4617.NASL
    descriptionTwo security issues were found in the Qt library, which could result in plugins and libraries being loaded from the current working directory, resulting in potential code execution.
    last seen2020-06-01
    modified2020-06-02
    plugin id133475
    published2020-02-05
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/133475
    titleDebian DSA-4617-1 : qtbase-opensource-src - security update
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were  
# extracted from Debian Security Advisory DSA-4617. The text 
# itself is copyright (C) Software in the Public Interest, Inc.
#

include("compat.inc");

if (description)
{
  script_id(133475);
  script_version("1.2");
  script_cvs_date("Date: 2020/02/07");

  script_cve_id("CVE-2020-0569", "CVE-2020-0570");
  script_xref(name:"DSA", value:"4617");

  script_name(english:"Debian DSA-4617-1 : qtbase-opensource-src - security update");
  script_summary(english:"Checks dpkg output for the updated package");

  script_set_attribute(
    attribute:"synopsis", 
    value:"The remote Debian host is missing a security-related update."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"Two security issues were found in the Qt library, which could result
in plugins and libraries being loaded from the current working
directory, resulting in potential code execution."
  );
  # https://security-tracker.debian.org/tracker/source-package/qtbase-opensource-src
  script_set_attribute(
    attribute:"see_also",
    value:"http://www.nessus.org/u?daec893f"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://packages.debian.org/source/stretch/qtbase-opensource-src"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://packages.debian.org/source/buster/qtbase-opensource-src"
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://www.debian.org/security/2020/dsa-4617"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"Upgrade the qtbase-opensource-src packages.

For the oldstable distribution (stretch), these problems have been
fixed in version 5.7.1+dfsg-3+deb9u2.

For the stable distribution (buster), these problems have been fixed
in version 5.11.3+dfsg1-1+deb10u3."
  );
  script_set_attribute(attribute:"risk_factor", value:"High");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:debian:debian_linux:qtbase-opensource-src");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:10.0");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:debian:debian_linux:9.0");

  script_set_attribute(attribute:"patch_publication_date", value:"2020/02/03");
  script_set_attribute(attribute:"plugin_publication_date", value:"2020/02/05");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Debian Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Debian/release", "Host/Debian/dpkg-l");

  exit(0);
}


include("audit.inc");
include("debian_package.inc");


if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Debian/release")) audit(AUDIT_OS_NOT, "Debian");
if (!get_kb_item("Host/Debian/dpkg-l")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;
if (deb_check(release:"10.0", prefix:"libqt5concurrent5", reference:"5.11.3+dfsg1-1+deb10u3")) flag++;
if (deb_check(release:"10.0", prefix:"libqt5core5a", reference:"5.11.3+dfsg1-1+deb10u3")) flag++;
if (deb_check(release:"10.0", prefix:"libqt5dbus5", reference:"5.11.3+dfsg1-1+deb10u3")) flag++;
if (deb_check(release:"10.0", prefix:"libqt5gui5", reference:"5.11.3+dfsg1-1+deb10u3")) flag++;
if (deb_check(release:"10.0", prefix:"libqt5network5", reference:"5.11.3+dfsg1-1+deb10u3")) flag++;
if (deb_check(release:"10.0", prefix:"libqt5opengl5", reference:"5.11.3+dfsg1-1+deb10u3")) flag++;
if (deb_check(release:"10.0", prefix:"libqt5opengl5-dev", reference:"5.11.3+dfsg1-1+deb10u3")) flag++;
if (deb_check(release:"10.0", prefix:"libqt5printsupport5", reference:"5.11.3+dfsg1-1+deb10u3")) flag++;
if (deb_check(release:"10.0", prefix:"libqt5sql5", reference:"5.11.3+dfsg1-1+deb10u3")) flag++;
if (deb_check(release:"10.0", prefix:"libqt5sql5-ibase", reference:"5.11.3+dfsg1-1+deb10u3")) flag++;
if (deb_check(release:"10.0", prefix:"libqt5sql5-mysql", reference:"5.11.3+dfsg1-1+deb10u3")) flag++;
if (deb_check(release:"10.0", prefix:"libqt5sql5-odbc", reference:"5.11.3+dfsg1-1+deb10u3")) flag++;
if (deb_check(release:"10.0", prefix:"libqt5sql5-psql", reference:"5.11.3+dfsg1-1+deb10u3")) flag++;
if (deb_check(release:"10.0", prefix:"libqt5sql5-sqlite", reference:"5.11.3+dfsg1-1+deb10u3")) flag++;
if (deb_check(release:"10.0", prefix:"libqt5sql5-tds", reference:"5.11.3+dfsg1-1+deb10u3")) flag++;
if (deb_check(release:"10.0", prefix:"libqt5test5", reference:"5.11.3+dfsg1-1+deb10u3")) flag++;
if (deb_check(release:"10.0", prefix:"libqt5widgets5", reference:"5.11.3+dfsg1-1+deb10u3")) flag++;
if (deb_check(release:"10.0", prefix:"libqt5xml5", reference:"5.11.3+dfsg1-1+deb10u3")) flag++;
if (deb_check(release:"10.0", prefix:"qt5-default", reference:"5.11.3+dfsg1-1+deb10u3")) flag++;
if (deb_check(release:"10.0", prefix:"qt5-flatpak-platformtheme", reference:"5.11.3+dfsg1-1+deb10u3")) flag++;
if (deb_check(release:"10.0", prefix:"qt5-gtk-platformtheme", reference:"5.11.3+dfsg1-1+deb10u3")) flag++;
if (deb_check(release:"10.0", prefix:"qt5-qmake", reference:"5.11.3+dfsg1-1+deb10u3")) flag++;
if (deb_check(release:"10.0", prefix:"qt5-qmake-bin", reference:"5.11.3+dfsg1-1+deb10u3")) flag++;
if (deb_check(release:"10.0", prefix:"qtbase5-dev", reference:"5.11.3+dfsg1-1+deb10u3")) flag++;
if (deb_check(release:"10.0", prefix:"qtbase5-dev-tools", reference:"5.11.3+dfsg1-1+deb10u3")) flag++;
if (deb_check(release:"10.0", prefix:"qtbase5-doc", reference:"5.11.3+dfsg1-1+deb10u3")) flag++;
if (deb_check(release:"10.0", prefix:"qtbase5-doc-html", reference:"5.11.3+dfsg1-1+deb10u3")) flag++;
if (deb_check(release:"10.0", prefix:"qtbase5-examples", reference:"5.11.3+dfsg1-1+deb10u3")) flag++;
if (deb_check(release:"10.0", prefix:"qtbase5-private-dev", reference:"5.11.3+dfsg1-1+deb10u3")) flag++;
if (deb_check(release:"9.0", prefix:"libqt5concurrent5", reference:"5.7.1+dfsg-3+deb9u2")) flag++;
if (deb_check(release:"9.0", prefix:"libqt5core5a", reference:"5.7.1+dfsg-3+deb9u2")) flag++;
if (deb_check(release:"9.0", prefix:"libqt5dbus5", reference:"5.7.1+dfsg-3+deb9u2")) flag++;
if (deb_check(release:"9.0", prefix:"libqt5gui5", reference:"5.7.1+dfsg-3+deb9u2")) flag++;
if (deb_check(release:"9.0", prefix:"libqt5network5", reference:"5.7.1+dfsg-3+deb9u2")) flag++;
if (deb_check(release:"9.0", prefix:"libqt5opengl5", reference:"5.7.1+dfsg-3+deb9u2")) flag++;
if (deb_check(release:"9.0", prefix:"libqt5opengl5-dev", reference:"5.7.1+dfsg-3+deb9u2")) flag++;
if (deb_check(release:"9.0", prefix:"libqt5printsupport5", reference:"5.7.1+dfsg-3+deb9u2")) flag++;
if (deb_check(release:"9.0", prefix:"libqt5sql5", reference:"5.7.1+dfsg-3+deb9u2")) flag++;
if (deb_check(release:"9.0", prefix:"libqt5sql5-ibase", reference:"5.7.1+dfsg-3+deb9u2")) flag++;
if (deb_check(release:"9.0", prefix:"libqt5sql5-mysql", reference:"5.7.1+dfsg-3+deb9u2")) flag++;
if (deb_check(release:"9.0", prefix:"libqt5sql5-odbc", reference:"5.7.1+dfsg-3+deb9u2")) flag++;
if (deb_check(release:"9.0", prefix:"libqt5sql5-psql", reference:"5.7.1+dfsg-3+deb9u2")) flag++;
if (deb_check(release:"9.0", prefix:"libqt5sql5-sqlite", reference:"5.7.1+dfsg-3+deb9u2")) flag++;
if (deb_check(release:"9.0", prefix:"libqt5sql5-tds", reference:"5.7.1+dfsg-3+deb9u2")) flag++;
if (deb_check(release:"9.0", prefix:"libqt5test5", reference:"5.7.1+dfsg-3+deb9u2")) flag++;
if (deb_check(release:"9.0", prefix:"libqt5widgets5", reference:"5.7.1+dfsg-3+deb9u2")) flag++;
if (deb_check(release:"9.0", prefix:"libqt5xml5", reference:"5.7.1+dfsg-3+deb9u2")) flag++;
if (deb_check(release:"9.0", prefix:"qt5-default", reference:"5.7.1+dfsg-3+deb9u2")) flag++;
if (deb_check(release:"9.0", prefix:"qt5-gtk-platformtheme", reference:"5.7.1+dfsg-3+deb9u2")) flag++;
if (deb_check(release:"9.0", prefix:"qt5-qmake", reference:"5.7.1+dfsg-3+deb9u2")) flag++;
if (deb_check(release:"9.0", prefix:"qtbase5-dev", reference:"5.7.1+dfsg-3+deb9u2")) flag++;
if (deb_check(release:"9.0", prefix:"qtbase5-dev-tools", reference:"5.7.1+dfsg-3+deb9u2")) flag++;
if (deb_check(release:"9.0", prefix:"qtbase5-doc", reference:"5.7.1+dfsg-3+deb9u2")) flag++;
if (deb_check(release:"9.0", prefix:"qtbase5-doc-html", reference:"5.7.1+dfsg-3+deb9u2")) flag++;
if (deb_check(release:"9.0", prefix:"qtbase5-examples", reference:"5.7.1+dfsg-3+deb9u2")) flag++;
if (deb_check(release:"9.0", prefix:"qtbase5-private-dev", reference:"5.7.1+dfsg-3+deb9u2")) flag++;

if (flag)
{
  if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());
  else security_hole(0);
  exit(0);
}
else audit(AUDIT_HOST_NOT, "affected");
  • NASL familyGentoo Local Security Checks
    NASL idGENTOO_GLSA-202003-60.NASL
    descriptionThe remote host is affected by the vulnerability described in GLSA-202003-60 (QtCore: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in QtCore. Please review the CVE identifiers referenced below for details. Impact : An attacker could possibly execute arbitrary code with the privileges of the process or cause a Denial of Service condition. Workaround : There is no known workaround at this time.
    last seen2020-04-01
    modified2020-03-27
    plugin id134968
    published2020-03-27
    reporterThis script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/134968
    titleGLSA-202003-60 : QtCore: Multiple vulnerabilities
    code
    #
# (C) Tenable Network Security, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Gentoo Linux Security Advisory GLSA 202003-60.
#
# The advisory text is Copyright (C) 2001-2020 Gentoo Foundation, Inc.
# and licensed under the Creative Commons - Attribution / Share Alike 
# license. See http://creativecommons.org/licenses/by-sa/3.0/
#

include("compat.inc");

if (description)
{
  script_id(134968);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2020/03/31");

  script_cve_id("CVE-2019-18281", "CVE-2020-0569", "CVE-2020-0570");
  script_xref(name:"GLSA", value:"202003-60");

  script_name(english:"GLSA-202003-60 : QtCore: Multiple vulnerabilities");
  script_summary(english:"Checks for updated package(s) in /var/db/pkg");

  script_set_attribute(
    attribute:"synopsis", 
    value:
"The remote Gentoo host is missing one or more security-related
patches."
  );
  script_set_attribute(
    attribute:"description", 
    value:
"The remote host is affected by the vulnerability described in GLSA-202003-60
(QtCore: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in QtCore. Please review
      the CVE identifiers referenced below for details.
  
Impact :

    An attacker could possibly execute arbitrary code with the privileges of
      the process or cause a Denial of Service condition.
  
Workaround :

    There is no known workaround at this time."
  );
  script_set_attribute(
    attribute:"see_also",
    value:"https://security.gentoo.org/glsa/202003-60"
  );
  script_set_attribute(
    attribute:"solution", 
    value:
"All QtCore 5.12.x users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=dev-qt/qtcore-5.12.3-r2'
    All QtCore 5.13.x users should upgrade to the latest version:
      # emerge --sync
      # emerge --ask --oneshot --verbose '>=dev-qt/qtcore-5.13.2-r2'"
  );
  script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:N/I:N/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:gentoo:linux:qtcore");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:gentoo:linux");

  script_set_attribute(attribute:"vuln_publication_date", value:"2019/10/23");
  script_set_attribute(attribute:"patch_publication_date", value:"2020/03/26");
  script_set_attribute(attribute:"plugin_publication_date", value:"2020/03/27");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"Gentoo Local Security Checks");

  script_dependencies("ssh_get_info.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/Gentoo/release", "Host/Gentoo/qpkg-list");

  exit(0);
}


include("audit.inc");
include("global_settings.inc");
include("qpkg.inc");

if (!get_kb_item("Host/local_checks_enabled")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
if (!get_kb_item("Host/Gentoo/release")) audit(AUDIT_OS_NOT, "Gentoo");
if (!get_kb_item("Host/Gentoo/qpkg-list")) audit(AUDIT_PACKAGE_LIST_MISSING);


flag = 0;

if (qpkg_check(package:"dev-qt/qtcore", unaffected:make_list("rge 5.12.3-r2", "rge 5.13.2-r2"), vulnerable:make_list("lt 5.13.2-r2"))) flag++;

if (flag)
{
  if (report_verbosity > 0) security_warning(port:0, extra:qpkg_report_get());
  else security_warning(0);
  exit(0);
}
else
{
  tested = qpkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, "QtCore");
}
  • NASL familyUbuntu Local Security Checks
    NASL idUBUNTU_USN-4275-1.NASL
    descriptionIt was discovered that Qt incorrectly handled certain PPM images. If a user or automated system were tricked into opening a specially crafted PPM file, a remote attacker could cause Qt to crash, resulting in a denial of service. This issue only affected Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. (CVE-2018-19872) It was discovered that Qt incorrectly handled certain text files. If a user or automated system were tricked into opening a specially crafted text file, a remote attacker could cause Qt to crash, resulting in a denial of service. This issue only affected Ubuntu 19.10. (CVE-2019-18281) It was discovered that Qt incorrectly searched for plugins in the current working directory. An attacker could possibly use this issue to execute arbitrary code. (CVE-2020-0569) It was discovered that Qt incorrectly searched for libraries relative to the current working directory. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 19.10. (CVE-2020-0570). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen2020-06-01
    modified2020-06-02
    plugin id133647
    published2020-02-12
    reporterUbuntu Security Notice (C) 2020 Canonical, Inc. / NASL script (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/133647
    titleUbuntu 16.04 LTS / 18.04 LTS / 19.10 : qtbase-opensource-src vulnerabilities (USN-4275-1)

References