Today, 20th of March 2024, we have released two service releases across the latest versions of QlikView to patch the reported issue. All versions of QlikView prior to and including the releases below are impacted:
QlikView May 2023 SR1 (12.80.20100)
QlikView May 2022 SR2 (12.70.20200)
Call to Action
As no workarounds can be provided, Customers should upgrade QlikView to one of the following versions that contain the fix:
QlikView May 2023 SR2 (12.80.20200)
QlikView May 2022 SR3 (12.70.20300)
This issue only impacts QlikView. Other Qlik data analytics products including Qlik Cloud and Qlik Sense Enterprise on Windows are not impacted.
Additional Details
All Qlik software can be downloaded from our official Qlik Download page (customer login required). Follow best practices when upgrading QlikView.
The Security Notice label is used to notify customers about security patches and upgrades that require a customer’s action. Please subscribe to the ‘Security Notice’ label to be notified of future updates.
Frequently Asked Questions
Q: Is the vulnerability present in the QlikView Plugin or other QlikView products? A: The vulnerability is related to the MSI files on disk.
Q: Will deleting the MSI files mitigate the issue? A: Qlik does not consider removing the MSI files a complete workaround. A server user can restore them.
Your Question:Can you confirm that this is only an issue when running an install or upgrade rather than an ongoing issue in an already installed environment? Or is there a component of the installer that can be leveraged (perhaps via uninstaller) to expose this?
Looking at the Release Notes which lists the bug, it seems it's to do with leaving MSI files on disk that would be accessible to non-admins... which I guess means it affects existing installs too. Although this doesn't sound like a "race condition" as described in the security bulletin.
Answer:The vulnerability is caused by the installers being left behind post-upgrade or installation. These installers can potentially be launched by a local user without Administrative Privileges.
It exists in all QlikView installations.
Your Question:Also clarity on whether it affects QlikView Server AND QlikView Desktop or just one or the other would be useful.
Answer:This issue is present in all QlikView Installers. Any package is affected.
Your Question:What kind of events can be caused by being able to run with administrator privileges? For example, is it possible for the system to be stopped or destroyed without permission?
Answer:A non-administrator user should never be able to launch the QlikView Installer and modify the installation. Applying the listed patches plugs this vulnerability.
In other words, even if it can be executed with administrator privileges, is it correct to understand that a non-administrator user cannot stop or destroy the system?
However, in your response to others, you say that "These installers can potentially be launched by a local user without Administrative Privileges". Do we have to worry about local users starting, stopping, or modifying the system?
The MSI file QlikViewServerx64.msi is located in the following folder on our server machine. My understanding is that QlikViewServerx64.msi is generated by the execution of QlikViewServer_x64Setup.exe. Also my understanding is that in the environment where I run QlikViewServer_x64Setup.exe, QlikViewServerx64.msi is always generated. Am I correct in my understanding?
Is this vulnerability not only an installation issue, but also a vulnerability in a Windows environment running QlikView or the QlikView plug-in, i.e. in an environment where QlikView is used after QlikView has been installed?
Hello @Sonja_Bauernfeind , thanks for your support. If we shift-delete the MSI file, so that a server user cannot restore them, would that be considered a sufficient workaround please? Best, Wouter
This site says "A race condition exists in the QlikView installer executable". I would like to know if the presence of a race condition in the installer executable also means that the QlikView environment that is already installed is also vulnerable.
Is the "access" described in "a user with existing access to the Windows environment running QlikView or the QlikView plugin" an OOS-level access, e.g. on a remote desktop? If the user only accesses at the browser level, is it safe to assume that there is no problem?
