[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <CAFNQBQwdQMYSu4cO_WwiupeQJOEyK=mSgHikCNFK4qqbNjTM=A@mail.gmail.com>
Date: Fri, 2 Aug 2024 15:00:10 +0000
From: Andri Yngvason <andri@...vason.is>
To: Solar Designer <solar@...nwall.com>
Cc: Dane Bouchie <dbouchie@...dimed.com>,
"oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>, Travis Wise <travis@...esquared.com>,
"security@...pberrypi.com" <security@...pberrypi.com>, Simon Long <simon@...pberrypi.com>,
"Moritz M??hlenhoff" <jmm@...til.org>, Salvatore Bonaccorso <carnil@...ian.org>
Subject: Re: Neat VNC Security Vulnerability
fös., 2. ágú. 2024 kl. 14:53 skrifaði Solar Designer <solar@...nwall.com>:
>
> On Fri, Aug 02, 2024 at 02:41:18PM +0000, Dane Bouchie wrote:
> > The client chooses the security type, so they can pass in "None" to the switch statement. is_allowed_security_type() now prevents that.
>
> Oh, so was the issue a trivial authentication bypass? Evidently, logic
> errors like this are easy to miss in plain sight.
>
Yes, and yes.
> switch (type) {
> case RFB_SECURITY_TYPE_NONE:
> security_handshake_ok(client, NULL);
> client->state = VNC_CLIENT_STATE_WAITING_FOR_INIT;
> break;
>
> Should the above RFB_SECURITY_TYPE_NONE support continue to exist in the
> code at all, if RFB_SECURITY_TYPE_NONE is never added to the allowed
> security types array that the code now pre-checks against? Maybe it
> should be #if 0'ed out, leaving it only as an example for debugging?
>
It is added to the list if no authentication is required.
Regards,
Andri
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
