製品・ソフトウェアに関する情報

JVN脆弱性詳細

Qt の QSslSocket における SSL サーバになりすまされる脆弱性

Title	Qt の QSslSocket における SSL サーバになりすまされる脆弱性
Summary	Qt の QSslSocket は、X.509 証明書の Subject の Common Name フィールドに、ワイルドカードを用いた IP アドレスを許容するため、任意の SSL サーバになりすまされる脆弱性が存在します。
Possible impacts	中間者攻撃 (man-in-the-middle attack) により、正規の認証局が発行したように巧妙に細工された証明書を介して、任意の SSL サーバになりすまされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	June 29, 2012, midnight
Registration Date	July 3, 2012, 2:01 p.m.
Last Update	July 3, 2012, 2:01 p.m.

Affected System

ノキア

Qt 4.7.0-rc1 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2010-5076	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-5076
National Vulnerability Database (NVD)
2	CVE-2010-5076	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2010-5076

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
Qt
1	Commit 5f6018564668d368f75e431c4cdac88d7421cff0	http://qt.gitorious.org/qt/qt/commit/5f6018564668d368f75e431c4cdac88d7421cff0
2	Commit 846f1b44eea4bb34d080d055badb40a4a13d369e	http://qt.gitorious.org/qt/qt/commit/846f1b44eea4bb34d080d055badb40a4a13d369e
3	SSL wildcard verification too broad	https://bugreports.qt-project.org/browse/QTBUG-4455
Red Hat Security Advisory
4	RHSA-2012:0880	http://rhn.redhat.com/errata/RHSA-2012-0880.html

Change Log

No	Changed Details	Date of change
0	[2012年07月03日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2010-5076

Summary	QSslSocket in Qt before 4.7.0-rc1 recognizes a wildcard IP address in the subject's Common Name field of an X.509 certificate, which might allow man-in-the-middle attackers to spoof arbitrary SSL servers via a crafted certificate issued by a legitimate Certification Authority.
Publication Date	June 30, 2012, 4:55 a.m.
Registration Date	Jan. 29, 2021, 11:10 a.m.
Last Update	Nov. 21, 2024, 10:22 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://qt.gitorious.org/qt/qt/commit/5f6018564668d368f75e431c4cdac88d7421cff0	Exploit Patch
2	http://qt.gitorious.org/qt/qt/commit/846f1b44eea4bb34d080d055badb40a4a13d369e	Patch
3	http://rhn.redhat.com/errata/RHSA-2012-0880.html
4	http://secunia.com/advisories/41236	Vendor Advisory
5	http://secunia.com/advisories/49604	Vendor Advisory
6	http://secunia.com/advisories/49895	Vendor Advisory
7	http://www.ubuntu.com/usn/USN-1504-1
8	http://www.westpoint.ltd.uk/advisories/wp-10-0001.txt
9	https://bugreports.qt-project.org/browse/QTBUG-4455
10	http://qt.gitorious.org/qt/qt/commit/5f6018564668d368f75e431c4cdac88d7421cff0	Exploit Patch
11	https://bugreports.qt-project.org/browse/QTBUG-4455
12	http://www.westpoint.ltd.uk/advisories/wp-10-0001.txt
13	http://www.ubuntu.com/usn/USN-1504-1
14	http://secunia.com/advisories/49895	Vendor Advisory
15	http://secunia.com/advisories/49604	Vendor Advisory
16	http://secunia.com/advisories/41236	Vendor Advisory
17	http://rhn.redhat.com/errata/RHSA-2012-0880.html
18	http://qt.gitorious.org/qt/qt/commit/846f1b44eea4bb34d080d055badb40a4a13d369e	Patch

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html