After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 678434 - Vino leaks clipboard activity to unauthenticated clients
Vino leaks clipboard activity to unauthenticated clients
Status: RESOLVED FIXED
Product: vino
Classification: Applications
Component: Server
2.32.x
Other Linux
: Normal critical
: ---
Assigned To: Vino Maintainer(s)
Vino Maintainer(s)
Depends on:
Blocks:
 
 
Reported: 2012-06-20 02:00 UTC by nandhp
Modified: 2012-12-17 22:23 UTC
See Also:
GNOME target: ---
GNOME version: ---

Attachments
patch (872 bytes, patch)
2012-12-17 05:11 UTC, Huzaifa Sidhpurwala (Red Hat Security Response) 		committed Details | Review

Description nandhp 2012-06-20 02:00:53 UTC 
The Vino VNC server transmits all clipboard activity to viewers, including those who have not authenticated.

Steps to reproduce:

1. Enable vino (with password protection).
2. Connect to the VNC server with socat or netcat or telnet.
   socat - tcp4:localhost:5900
3. Do not attempt to authenticate to the VNC server.
4. Copy some text.
5. Observe that the copied text is immediately echoed in the terminal window, which should not happen.

This problem occurs with vino-server versions 2.32 (Gentoo) and 2.28 (Debian stable).
Comment 1 Alexandre Rostovtsev 2012-09-14 05:57:40 UTC 
Appears to affect all vino versions at least up to 3.4.2 (did not test 3.5.x).
Comment 2 Huzaifa Sidhpurwala (Red Hat Security Response) 2012-09-18 04:03:14 UTC 
This is a security issue, it has been assigned CVE-2012-4429:
http://www.openwall.com/lists/oss-security/2012/09/14/1
Comment 3 Huzaifa Sidhpurwala (Red Hat Security Response) 2012-10-19 04:57:32 UTC 
ping, any updates on this bug?
Comment 4 Huzaifa Sidhpurwala (Red Hat Security Response) 2012-12-14 07:11:46 UTC 
Quick note:
This also affects the latest version of vino, upto 3.6.2.
Comment 5 Huzaifa Sidhpurwala (Red Hat Security Response) 2012-12-17 05:11:22 UTC 
Created attachment 231701 [details] [review]
patch
Comment 6 Huzaifa Sidhpurwala (Red Hat Security Response) 2012-12-17 05:17:51 UTC 
Enclosed patch should fix the problem.

vino_server_clipboard_cb() in vino-server.c is the callback which is triggered when a clipboard copy event is fired.

After doing some initial checks, (1. If there are any connected clients, 2. If the server is on hold etc), it converts the text to UTF-8 and then passes it on to
rfbSendServerCutText(). Here data is pasted to each client, without verifying if the client is authenticated.

The patch checks if the client is authenticated and only then it allows the clipboard text to be sent to it.
Comment 7 David King 2012-12-17 22:23:13 UTC 
Comment on attachment 231701 [details] [review]
patch

Thanks for the patch. I pushed a tidied version with the correct attribution to master and gnome-3-6 as commit 9c8b9f81205203db6c31068babbfb8a734acacdb and eb3752eed13473c4db20aedec14eb28de914abf0.