Bug 857250 - (CVE-2012-4429) CVE-2012-4429 vino: information leak and authentication bypass
CVE-2012-4429 vino: information leak and authentication bypass
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
: Security
Depends On: 857252 888637 888638
Blocks: 857251
  Show dependency treegraph
Reported: 2012-09-13 18:40 EDT by Vincent Danen
Modified: 2015-11-24 10:22 EST (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2013-01-22 00:18:41 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Vincent Danen 2012-09-13 18:40:44 EDT
It was reported [1],[2] that vino transmits all clipboard activity to anything listening on port 5900, including to clients that have not authenticated.  If a user were to have vino enabled (including requiring authentication), a remote user could access the port and see anything the user added to the clipboard sent over the port.

To reproduce, enable vino with password protection (i.e. execute vino-preferences).  Connect to the VNC port (either locally or remotely), for instance:

% nc -4 odvfc17 5900
RFB 003.007
@??zsh: command not found: zsh:@??[vdanen@odvfc17]

The above two bits of output are from copying in the GNOME terminal, locally, on the system running vino.

The above was tested with Fedora 17's 3.4.2 version; the report indicates that 2.32 on Gentoo and 2.28 on Debian are also vulnerable.

[1] https://bugs.gentoo.org/show_bug.cgi?id=434930
[2] https://bugzilla.gnome.org/show_bug.cgi?id=678434
Comment 2 Vincent Danen 2012-09-13 18:49:21 EDT
Created vino tracking bugs for this issue

Affects: fedora-all [bug 857252]
Comment 3 Jan Lieskovsky 2012-09-14 05:04:29 EDT
The CVE identifier of CVE-2012-4429 has been assigned to this issue:
Comment 4 Huzaifa S. Sidhpurwala 2012-12-17 00:18:25 EST
Proposed upstream patch at:
Comment 5 Huzaifa S. Sidhpurwala 2012-12-17 22:41:43 EST
Upstream patch:
Comment 8 errata-xmlrpc 2013-01-21 17:37:32 EST
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2013:0169 https://rhn.redhat.com/errata/RHSA-2013-0169.html

Note You need to log in before you can comment on or make changes to this bug.