full-disclosure - Re: VNC viewers: Clipboard of host automatically sent to remote machine

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4F1F01C6.8050109@coochey.net>
Date: Tue, 24 Jan 2012 19:08:54 +0000
From: Giles Coochey <giles@...chey.net>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: VNC viewers: Clipboard of host automatically
 sent to remote machine

On 24/01/2012 16:06, Ben Bucksch wrote:
> On 24.01.2012 16:32, Giles Coochey wrote:
>> Many viewers, including RealVNC have the option to disable the shared
>> clipboard. Check your preferences.
> Indeed. But Vinagre doesn't.
>
> Even then, that is not sufficient, as explained in length.
>
I'm afraid as others have pointed out that by putting something in the 
Clipboard any local application can access that data, that's the point 
of the clipboard, to transfer the data between applications.

Now your argument is that you use an application that passes that 
clipboard to a remote server. From the forum posts I have seen this is 
an often requested feature and not usually considered a bug. The bug is 
what you're using the clipboard for, as you could have phrased your post 
that the problem is that the clipboard uses a plain text storage 
mechanism which makes the clipboard unsuitable for secure storage.

In any case, while not an option, there is a trivial patch to disable 
clipboard sharing in Vinagre:

--- a/src/vncconnection.c
+++ b/src/vncconnection.c
@@ -1579,14 +1579,7 @@
  gboolean vnc_connection_client_cut_text(VncConnection *conn,
  					const void *data, size_t length)
  {
-	guint8 pad[3] = {0};
-
-	vnc_connection_buffered_write_u8(conn, 6);
-	vnc_connection_buffered_write(conn, pad, 3);
-	vnc_connection_buffered_write_u32(conn, length);
-	vnc_connection_buffered_write(conn, data, length);
-	vnc_connection_buffered_flush(conn);
-	return !vnc_connection_has_error(conn);
+	return TRUE;
  }

Download attachment "smime.p7s" of type "application/pkcs7-signature" (4320 bytes)

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/