Qt 4.6.3 - 'QSslSocketBackendPrivate::transmit()' Denial of Service

Source:
http://aluigi.org/adv/qtsslame-adv.txt

#######################################################################

Luigi Auriemma

Application: Qt
http://qt.nokia.com
Versions: <= 4.6.3
Platforms: Windows, Mac OS X, Linux, mobile devices
Bug: QSSLsocket endless loop
Exploitation: remote, versus server
Date: 29 Jun 2010
Author: Luigi Auriemma
e-mail: [email protected]
web: aluigi.org


#######################################################################


1) Introduction
2) Bug
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


From vendor's website:
"Qt is a cross-platform application and UI framework.
Using Qt, you can write web-enabled applications once and deploy them
across desktop, mobile and embedded operating systems without rewriting
the source code."


#######################################################################

======
2) Bug
======


The part of the network library which handles the SSL connection can be
tricked into an endless loop that freezes the whole application with
CPU at 100%.

The problem is located in the QSslSocketBackendPrivate::transmit()
function in src_network_ssl_qsslsocket_openssl.cpp that never exits
from the main "while" loop.

Any application that acts as a server (and client, but has no security
impact in this scenario) and uses SSL through the QSslSocket class is
vulnerable and some examples are the Mumble server (Murmur),
Multi-Computer Virtual Whiteboard and so on.


#######################################################################

===========
3) The Code
===========

http://aluigi.org/poc/qtsslame.zip
or
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/34227.zip (qtsslame.zip)


#######################################################################

======
4) Fix
======


No fix.


#######################################################################