CVE-2010-3374

Severity

69%

Complexity

34%

Confidentiality

165%

Per: http://qt.nokia.com/about/news/security-announcement-qt-creator-2.0.0-for-desktop-platforms 'The issue does not affect Windows or Mac OS X.'

Qt Creator before 2.0.1 places a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current working directory.

Per: http://qt.nokia.com/about/news/security-announcement-qt-creator-2.0.0-for-desktop-platforms 'The issue does not affect Windows or Mac OS X.'

CVSS 2.0 Base Score 6.9. CVSS Attack Vector: local. CVSS Attack Complexity: medium. CVSS Vector: (AV:L/AC:M/Au:N/C:C/I:C/A:C).

Overview

Type

Nokia Qt Creator

First reported 14 years ago

2010-10-04 21:00:00

Last updated 14 years ago

2010-10-05 04:00:00

Affected Software

Nokia Qt Creator 0.9.1 beta

0.9.1

Nokia Qt Creator 0.9.2 release candidate 1

0.9.2

Nokia Qt Creator 1.0.0

1.0.0

Nokia Qt Creator 1.1.0

1.1.0

Nokia Qt Creator 1.1.0 release candidate 1

1.1.0

Nokia Qt Creator 1.2.0

1.2.0

Nokia Qt Creator 1.2.90

1.2.90

Nokia Qt Creator 1.3.0

1.3.0

Nokia Qt Creator 1.3.0 beta

1.3.0

Nokia Qt Creator 1.3.0 release candidate 1

1.3.0

Nokia Qt Creator 1.3.1

1.3.1

Nokia Qt Creator 2.0.0 alpha

2.0.0

Nokia Qt Creator 2.0.0 beta

2.0.0

Nokia Qt Creator 2.0.0 release candidate 1

2.0.0

References

http://qt.nokia.com/about/news/security-announcement-qt-creator-2.0.0-for-desktop-platforms

Patch, Vendor Advisory

MDVSA-2010:193

http://www.qt.gitorious.org/qt-creator/qt-creator/commit/3c00715c8e90c57953ec4a8716110f6954e524e4

Patch

43672

ADV-2010-2559

Vendor Advisory

ADV-2010-2560

Vendor Advisory

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.