QlikView - New Security Patches Available Now

[Sonja_Bauernfeind]

Update 21st of March 16:00 CET: published CVE number
Update 27th of March 10:45 CET: added FAQ

Hello Qlik Users,

A security issue in QlikView has been identified and patches have been made available. Details can be found in the Security Bulletin High Severity Security fix for QlikView (CVE-2024-29863).

Today, 20th of March 2024, we have released two service releases across the latest versions of QlikView to patch the reported issue. All versions of QlikView prior to and including the releases below are impacted:

• QlikView May 2023 SR1 (12.80.20100)
• QlikView May 2022 SR2 (12.70.20200)

Call to Action

As no workarounds can be provided, Customers should upgrade QlikView to one of the following versions that contain the fix:

• QlikView May 2023 SR2 (12.80.20200)
• QlikView May 2022 SR3 (12.70.20300)

This issue only impacts QlikView. Other Qlik data analytics products including Qlik Cloud and Qlik Sense Enterprise on Windows are not impacted.

Additional Details

• All Qlik software can be downloaded from our official Qlik Download page (customer login required). Follow best practices when upgrading QlikView. 
• Qlik provides patches for major releases until the next Initial or Service Release is generally available. See Release Management Policy for Qlik Software. 
• Notwithstanding, additional patches for earlier releases may be made available at Qlik’s discretion.
• The information in this post and Security Bulletin High Severity Security fix for QlikView (CVE-2024-29863) is disclosed in accordance with our published Security and Vulnerability Policy. 

The Security Notice label is used to notify customers about security patches and upgrades that require a customer’s action. Please subscribe to the ‘Security Notice’ label to be notified of future updates. 

Frequently Asked Questions

Q: Is the vulnerability present in the QlikView Plugin or other QlikView products? 
A: The vulnerability is related to the MSI files on disk.

Q: Will deleting the MSI files mitigate the issue?
A: Qlik does not consider removing the MSI files a complete workaround. A server user can restore them.

[to759_PM]

@Sonja_Bauernfeind 

Impacted version number and fixed version numer are the same.

"All versions of QlikView prior to and including the releases below are impacted"

[Sonja_Bauernfeind]

Hello @to759_PM That should already be resolved, thank you!

[AlexOmetis]

Hi,

Can you confirm that this is only an issue when running an install or upgrade rather than an ongoing issue in an already-installed environment? Or is there a component of the installer that can be leveraged (perhaps via uninstaller) to expose this? 

Thanks

[Sonja_Bauernfeind]

Hello @AlexOmetis 

Let me get clarity on this for you.

All the best,
Sonja 

[AlexOmetis]

Looking at the Release Notes which lists the bug, it seems it's to do with leaving MSI files on disk that would be accessible to non-admins... which I guess means it affects existing installs too. Although this doesn't sound like a "race condition" as described in the security bulletin.

QV-25114

Local Privilege Escalation

Installers sometimes left .msi files on Local disc, which could result in a security problem. This is now fixed, so that administrator rights are needed to access them.

[AlexOmetis]

Also clarity on whether it affects QlikView Server AND QlikView Desktop or just one or the other would be useful.

[Sonja_Bauernfeind]

Hello @AlexOmetis 

We're actively looking into your questions. The internal ID for the investigation is QB-25717.

All the best,
Sonja 

[sis]

@Sonja_Bauernfeind 

What kind of events can be caused by being able to run with administrator privileges?
For example, is it possible for the system to be stopped or destroyed without permission?

Thanks.

[Sonja_Bauernfeind]

@sis Adding your question to our investigation.

[xudo]

In the email of our Qlik partner is stated "If successfully exploited, a user with existing access to the Windows environment running QlikView or the QlikView plugin may be able to escalate their privileges to that of administrator."

What is meant here with "QlikView plugin"? Is there a vulnerability related to this plugin?