Bug 857250 (CVE-2012-4429) - CVE-2012-4429 vino: information leak and authentication bypass
Summary: CVE-2012-4429 vino: information leak and authentication bypass
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2012-4429
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 857252 888637 888638
Blocks: 857251
TreeView+ depends on / blocked
 
Reported: 2012-09-13 22:40 UTC by Vincent Danen
Modified: 2019-09-29 12:55 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2013-01-22 05:18:41 UTC


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2013:0169 0 normal SHIPPED_LIVE Moderate: vino security update 2013-01-22 03:34:50 UTC

Description Vincent Danen 2012-09-13 22:40:44 UTC
It was reported [1],[2] that vino transmits all clipboard activity to anything listening on port 5900, including to clients that have not authenticated.  If a user were to have vino enabled (including requiring authentication), a remote user could access the port and see anything the user added to the clipboard sent over the port.

To reproduce, enable vino with password protection (i.e. execute vino-preferences).  Connect to the VNC port (either locally or remotely), for instance:

% nc -4 odvfc17 5900
RFB 003.007
@??zsh: command not found: zsh:@??[vdanen@odvfc17]

The above two bits of output are from copying in the GNOME terminal, locally, on the system running vino.

The above was tested with Fedora 17's 3.4.2 version; the report indicates that 2.32 on Gentoo and 2.28 on Debian are also vulnerable.

[1] https://bugs.gentoo.org/show_bug.cgi?id=434930
[2] https://bugzilla.gnome.org/show_bug.cgi?id=678434

Comment 2 Vincent Danen 2012-09-13 22:49:21 UTC
Created vino tracking bugs for this issue

Affects: fedora-all [bug 857252]

Comment 3 Jan Lieskovsky 2012-09-14 09:04:29 UTC
The CVE identifier of CVE-2012-4429 has been assigned to this issue:
http://www.openwall.com/lists/oss-security/2012/09/14/1

Comment 4 Huzaifa S. Sidhpurwala 2012-12-17 05:18:25 UTC
Proposed upstream patch at:
http://bugzilla-attachments.gnome.org/attachment.cgi?id=231701

Comment 5 Huzaifa S. Sidhpurwala 2012-12-18 03:41:43 UTC
Upstream patch:
http://git.gnome.org/browse/vino/commit/?id=9c8b9f81205203db6c31068babbfb8a734acacdb

Comment 8 errata-xmlrpc 2013-01-21 22:37:32 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2013:0169 https://rhn.redhat.com/errata/RHSA-2013-0169.html


Note You need to log in before you can comment on or make changes to this bug.