Bug 525788

Summary:	CVE-2009-3384 WebKit, qt: Multiple security issues while handling FTP directory listings
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	unspecified	CC:	jreznik, rcvalle, security-response-team, than, tpelka, vdanen
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-03-07 06:35:15 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	538235, 549881, 572756, 572757, 572758
Bug Blocks:

Description Jan Lieskovsky 2009-09-25 18:15:59 UTC

Multiple security flaws (integer underflow, invalid pointer dereference,
buffer underflow and a denial of service) were found in the way WebKit's
FTP parser used to process remote FTP directory listings. If a remote
FTP server issued a specially-crafted FTP command, it could lead to
disclosure of sensitive information, denial of service (application crash) or,
potentially to execution of arbitrary code, once the command was parsed.

Upstream bug report:
--------------------
https://bugs.webkit.org/show_bug.cgi?id=29294

Upstream patch:
---------------
http://trac.webkit.org/changeset/48725

Credit:
-------
Michal Zalewski

Comment 1 Jan Lieskovsky 2009-09-25 18:52:27 UTC

This issue affects latest versions of WebKit package, as shipped with
Fedora release of 10 and 11 (WebKit-1.1.0-0.16.svn40351.fc10 and WebKit-1.1.1-1.fc11). 

This issue affects latest versions of qt package, as shipped with
Fedora release of 10 and 11 (qt-4.5.2-3.fc10 and qt-4.5.2-3.fc11).

Comment 4 Jan Lieskovsky 2009-11-13 13:45:01 UTC

Public now via:
  http://threatpost.com/en_us/blogs/apple-patches-critical-safari-vulnerabilities-111109

Comment 5 Fedora Update System 2009-11-13 13:45:30 UTC

qt-4.5.3-9.fc12 has been submitted as an update for Fedora 12.
http://admin.fedoraproject.org/updates/qt-4.5.3-9.fc12

Comment 6 Fedora Update System 2009-11-14 03:30:24 UTC

qt-4.5.3-9.fc12 has been pushed to the Fedora 12 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2009-11-14 03:30:42 UTC

qt-4.5.3-9.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 Fedora Update System 2009-11-14 03:33:28 UTC

qt-4.5.3-9.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 12 Vincent Danen 2009-11-20 18:14:45 UTC

This issue does not affect kdelibs or qt3 as provided with Red Hat Enterprise Linux 3, 4, or 5.

QtWebKit was introduced in Qt version 4, and kdelibs would not use this code for Konqueror as it uses the FTP KIO slave.

Comment 22 Huzaifa S. Sidhpurwala 2012-03-07 06:35:15 UTC

This flaw was resolved in the version of webkitgtk shipped with Red Hat Enterprise Linux 6.0