pxcloud/spice
5
0
Fork 0
mirror of https://gitlab.uni-freiburg.de/opensourcevdi/spice synced 2025-12-26 22:48:19 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

spicec-x11: Change source of controller socket name, fixing CVE-2010-2792

Browse Source 
The socket name used to communicate between the xpi browser plugin and the
spicec was predictable allowing a non priviliged user on the same system
to create the socket before spicec does and thus intercept the messages from
the xpi to the client, including login credentials. This security vulnerability
has been registred with mitre as CVE-2010-2792:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2792

This patch changes the controller code to instead read the socket name
from an environment variable which gets set by the xpi before executing
the spicec, making the socketname private between the client and the xpi.

Note that this means that the controller will only work with an xpi which
has matching changes, the changes are present in the latest version of the
xpi as available as update for / with RHEL-5.5 and RHEL-6.0 .
This commit is contained in:
Hans de Goede 2010-10-20 21:52:49 +02:00
parent 023d9c0d91
commit 79fffbf95d
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
client/controller.cpp
View File

@ -28,10 +28,6 @@
#ifdef WIN32
#define PIPE_NAME "SpiceController-%lu"
#elif defined(__i386__)
#define PIPE_NAME "/tmp/SpiceController-%llu.uds"
#else
#define PIPE_NAME "/tmp/SpiceController-%lu.uds"
#endif
Controller::Controller(ControllerInterface *handler)
@ -42,7 +38,15 @@ Controller::Controller(ControllerInterface *handler)
char pipe_name[PIPE_NAME_MAX_LEN];
ASSERT(_handler);
#ifdef WIN32
snprintf(pipe_name, PIPE_NAME_MAX_LEN, PIPE_NAME, Platform::get_process_id());
#else
char *p_socket = getenv("SPICE_XPI_SOCKET");
if (!p_socket) {
LOG_ERROR("Failed to get a controller connection (SPICE_XPI_SOCKET)");
}
strncpy(pipe_name, p_socket, sizeof(pipe_name));
#endif
LOG_INFO("Creating a controller connection %s", pipe_name);
_pipe = NamedPipe::create(pipe_name, *this);
if (!_pipe) {