Bug 743054 (CVE-2011-3365)

An input validation failure was discovered in KSSL (CVE-2011-3365) and Rekonq (CVE-2011-3366) in KDE SC 4.6.0 up to and including KDE SC 4.7.1, however upstream indicates that ealier versions of KDE SC may also be affected.  The upstream advisory [1] details are noted below:


The default rendering type for a QLabel is QLabel::AutoText, which uses
heuristics to determine whether to render the given content as plain text
or rich text.

When displaying a security dialog with a certificate, KSSL does not
properly force its QLabels to use QLabel::PlainText. As a result, if given
a certificate containing rich text in its fields, it will render the rich
text.

Specifically, a certificate containing a common name (CN) that has a table
element will cause the second line of the table to be displayed. This can
allow spoofing of the certificate's common name.

The vulnerability and technical information about the exploit were
provided by Tim Brown of Nth Dimension. We thank them for their 
responsible disclosure and cooperative handling of the matter.

Exploitation may trick the user into beliving a certificate is legitimate
when in fact it is invalid, and simply displayed incorrectly.


This has been corrected via the following git [2] commits:

4.6 branch: 9ca2b26f 90607b28
4.7 branch: bd70d4e5 86622e4d
frameworks: bd70d4e5 86622e4d

(Note: the second commit for each branch above is a fix for kio_http that
fixes a similar issue, but with only very minor security implications.)

And for Rekonq, the following commits correct it in git [3]:

85f454fa
526ce56f
d1711fff

Finally, Qt has also received a patch to warn users about sanitizing their QLabel [4].

[1] http://www.kde.org/info/security/advisory-20111003-1.txt
[2] http://quickgit.kde.org/?p=kdelibs.git&a=summary
[3] http://quickgit.kde.org/?p=rekonq.git&a=summary
[4] https://qt.gitorious.org/qt/qt/commit/31f7ecbdcdbafbac5bbfa693e4d060757244941b