Bug 957344 (CVE-2015-8378) - VUL-0: CVE-2015-8378: keepassx: passwords stored in plain text file when export is cancelled
Summary: VUL-0: CVE-2015-8378: keepassx: passwords stored in plain text file when expo...
Status: RESOLVED UPSTREAM
Alias: CVE-2015-8378
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other openSUSE 13.2
: P3 - Medium : Normal
Target Milestone: ---
Assignee: Dominique Leuenberger
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/159261/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-12-01 11:46 UTC by Marcus Meissner
Modified: 2015-12-01 13:28 UTC (History)
2 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Marcus Meissner 2015-12-01 11:46:12 UTC 
via oss-sec

http://seclists.org/oss-sec/2015/q4/409

    it seems that keepassx 0.4.3 export function are a bit buggy. Starting an
    export (using File / Export to / KeepassX XML file) and cancelling it leads to
    KeepassX saving a cleartext XML file in ~/.xml without any warning.

    This was reported privately to the Debian security team today, but it was
    actually reported publicly earlier in the Debian BTS. Unfortunately the
    maintainer didn't acknowledge the bug or forwarded it upstream, apparently.

    It's not a terrible bug per se because leaking a user password file on purpose
    would still require a lot of social engineering skills, but it still look like
    it should get a CVE (an user explicitly cancelling the export surely doesn't
    expect its passwords to be there in a hidden file.


    https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=791858


        canceling export operation creates cleartext copy of all of the user's
        KeePassX password database entries


        with Debian's default umask, the file is even world-readable in 
        multiuser machines


Use CVE-2015-8378.


References:
https://bugzilla.redhat.com/show_bug.cgi?id=1286730
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=791858
Comment 1 Dominique Leuenberger 2015-12-01 12:54:03 UTC 
openSUSE 13.2, Factory and Leap seem not to be affected , as we ship in all cases keepassx 2.0 (13.1: alpha6, Leap 42.1: beta1, Tumbleweed: beta2)

There if only a database / export to csv - and the function seems not to expose the error (no file created on cancel)

@Marcus: or is there a different way to reproduce it there?
Comment 2 Marcus Meissner 2015-12-01 13:28:20 UTC 
then it is likely not affected.