x2go-dev May 2013

x2go-dev@lists.x2go.org

30 participants
99 discussions

Bug#216: x2gobroker-agent: assumes wrong path for x2gobroker-agent.pl
by Anders Bruun Olsen 22 May '13

22 May '13

Package: x2gobroker Version: 0.0.2.2 (git) Severity: critical When I build debs (debuild -uc -us) for x2gobroker from git, after the recent security fix to x2gobroker-agent, the resulting x2gobroker-agent tries to run /usr/local/lib/x2go/x2gobroker-agent.pl instead of /usr/lib/x2go/x2gobroker-agent.pl. This means that autologin with x2gobroker does not work. -- Anders Bruun Olsen It-ansvarlig Det Danske Sprog- og Litteraturselskab (Society for Danish Language and Literature)

1 0

Re: [X2Go-Dev] x2go and (none)security
by Richard RW. Weinberger 21 May '13

21 May '13

----- Ursprüngliche Mail ----- > > From: Oleksandr Shneyder <oleksandr.shneyder(a)obviously-nice.de> > > Subject: Re: [X2Go-Dev] x2go and (none)security > > Date: 21. Mai 2013 10:40:45 MESZ > > To: x2go-dev(a)lists.berlios.de > > Cc: david(a)sigma-star.at, t.dierl(a)sigma-star.at > > > > Hello Richard, > > > > Am 18.05.2013 21:48, schrieb Richard Weinberger: > >> Hi x2go users/developers, > >> > >> while reviewing x2go I've encountered issues which scared hell out > >> of me. > >> The client seems to perform zero input validation. A rough server > >> can > >> easily crash the client > >> and most likely execute arbitrary code. > >> For example x2goSession ONMainWindow::getSessionFromString ( const > >> QString& string ), it is feed with input from the server. > >> --- > >> QStringList lst=string.split ( '|' ); > >> x2goSession s; > >> s.agentPid=lst[0]; > >> s.sessionId=lst[1]; > >> s.display=lst[2]; > >> s.server=lst[3]; > >> s.status=lst[4]; > >> s.crTime=lst[5]; > >> s.cookie=lst[6]; > >> s.clientIp=lst[7]; > >> s.grPort=lst[8]; > >> s.sndPort=lst[9]; > >> --- > >> If a line from the server, does not enough "|" we end up with > >> out-of-bound array access. > >> The source is full with such issues. > > > > You are right, it is possible, that X2Go Client can be crashed with > > the > > wrong output from the server. This issue could (and should) be > > easily > > fixed by replacing operator "[n]" with method "value(n)". However, > > I > > don't think, that this issue is so dramatic as you described it. > > Why > > some one should open a SSH/X2GO connection to "rough" server? I > > didn't > > see such use case yet, when an administrator of server want to > > crash the > > client application on a machine of his user. If a user root on your > > Linux system is not an evil person, who want crash the X2Go Client > > on > > your desktop, you should not worry about this issue. But if you > > living > > in the world of BOFH, please don't use the X2Go Client until this > > issue > > will be fixed. I'll fix it very soon. Every thought about client security? What happens if someone connects to another server? E.g. a support guys which need to connect to other customers. Using x2go you can take over his machine and sniff passwords to access other customers. > >> Finally I've also looked at the server. > >> In short, the 90's calx2go-dev(a)lists.berlios.deled, they want their setuid bugs back. > >> x2gosqlitewrapper.c just wrong, anyone can make it executing > >> whatever > >> binary he wants with higher privileges. > > > > Sorry, I don't understand what are you talking about. I not found > > the > > file "x2gosqlitewrapper.c" in the source tree of package "x2go > > server". > > If you found a security problem in the recent x2goserver code, > > please > > open a bug report on bug tracker, describe the problem and show how > > it > > can be used. In best case show an example of exploit and send a bug > > fix. > > Saying "it is just wrong, anyone can do something" is just your > > opinion > > without any arguments. I showed Mike already how the exploit works. He already released a fixed version of x2goserver and x2gobroker. Both contained the same broken code. If you don't understand the issue I'll happily explain it to you in private but I'll not post exploits on a public mailinglist. > > > >> But it's not only the code that worries me. > >> On Windows the client executes per default sshd and x11. Both are > >> listening on all available IP-Addresses. > > > > Yes, this components are required by X2Go Client. This services are > > configured by default to listen all IP-Adresses. It is possible to > > configure them to listen for connections only on localhost, but I > > see it > > just as "nice to have" feature. Starting this services is not > > creating > > backdoor on the system, otherwise most UNIX machines would be > > backdoor'ed, because they running same services. Furthermore, SSHD > > used > > by X2Go is running only with user privileges and opening an access > > for > > only one user and only shortly for each SSHFS connection. The rest > > time > > SSHD don't accept a SSH-connections. In addition, each Windows > > system > > have a firewall that by default configured to drop incoming > > TCP-connections. This make SSHD and X11 to be only accessible from > > localhost. > > > > > > > >> You silently install a user "sshuser" on Windows, which has the > >> password > >> of the currently logged in Windows user and give > >> him a login shell. > > > > This is so untrue! X2Go Client can not install users on Windows > > system. So? You install cygwin with a passwd file that maps to Windows users. sshd.exe uses that passwd file and one can login via network. Of course you need to know the passwort. But you open a security risk just by making sshd and x11 listening on 0.0.0.0! > > To be able to do something like that, X2Go Client must have an > > administrator privileges. All X2Go Client components running with > > user > > privileges. A SSHD open SSH access for current user and this is > > required > > for SSHFS, which used to export client directories to server. If > > you > > don't trust your server, just don't export your directories. And > > you > > should not do this, independent what kind of network FS are you > > using. > > It is always possible, that untrusted server can manipulate your > > data or > > credentials. It's impossible to open a SSH-Connection to your > > client > > until you don't exporting directories to server. Then please make sshd listen on localhost and forward the ssh port to the Server... > > > >> I haven't seen such a trainwreck of software for a long time. > >> By installing it on my system you've successfully backdoor'ed my > >> clients > >> and the server. > > > > I appreciated your criticism, but writing something like that in > > the ML > > of a community project is just not respecting the work of people, > > who > > spent a lot of their time and costs to develop something useful for > > others. I'm criticizing your code not you. If you cannot deal with that, not my problem. Thanks, //richard

4 4

x2go and (none)security
by Richard Weinberger 21 May '13

21 May '13

Hi x2go users/developers, while reviewing x2go I've encountered issues which scared hell out of me. The client seems to perform zero input validation. A rough server can easily crash the client and most likely execute arbitrary code. For example x2goSession ONMainWindow::getSessionFromString ( const QString& string ), it is feed with input from the server. --- QStringList lst=string.split ( '|' ); x2goSession s; s.agentPid=lst[0]; s.sessionId=lst[1]; s.display=lst[2]; s.server=lst[3]; s.status=lst[4]; s.crTime=lst[5]; s.cookie=lst[6]; s.clientIp=lst[7]; s.grPort=lst[8]; s.sndPort=lst[9]; --- If a line from the server, does not enough "|" we end up with out-of-bound array access. The source is full with such issues. Finally I've also looked at the server. In short, the 90's called, they want their setuid bugs back. x2gosqlitewrapper.c just wrong, anyone can make it executing whatever binary he wants with higher privileges. But it's not only the code that worries me. On Windows the client executes per default sshd and x11. Both are listening on all available IP-Addresses. You silently install a user "sshuser" on Windows, which has the password of the currently logged in Windows user and give him a login shell. I haven't seen such a trainwreck of software for a long time. By installing it on my system you've successfully backdoor'ed my clients and the server. Thanks, //richard

6 11

Google Chrome and chromium-browser both crash when their advanced settings menu is accessed (Windows X2GoClient)
by Stefan Baur 21 May '13

21 May '13

Hi, this is basically a repeat of Message-ID: <4FB3F9DA.1020602(a)stefanbaur.de>, as the problem still hasn't been fixed. I'm not copying it to the bugtracker directly as I am not sure whether it is a client- or server-side issue, or both. @DEVs: Please advise how it should be tagged, or forward and tag it yourself. What's new is that I've now also tried it on Debian Wheezy with the following packages installed on the server: dpkg -l | grep x2go ii cups-x2go 3.0.0.4-0~x2go1+wheezy~main~62~build1 all Virtual X2Go printer for CUPS ii x2go-keyring 2012.07.23+wheezy~main~17~build1 all GnuPG keys of all X2Go developers and the X2Go archive ii x2goagent 2:3.5.0.20-0+wheezy~main~405~build1 all X2Go agent ii x2goserver 4.0.0.1-0~x2go1+wheezy~main~648~build1 i386 X2Go server daemon scripts ii x2goserver-extensions 4.0.0.1-0~x2go1+wheezy~main~648~build1 all X2Go server daemon scripts (extensions) ii x2goserver-printing 4.0.0.1-0~x2go1+wheezy~main~648~build1 all X2Go server daemon scripts (printing) dpkg -l | grep nx ii libnx-x11 2:3.5.0.20-0+wheezy~main~405~build1 i386 nx-X11 ii nxagent 2:3.5.0.20-0+wheezy~main~405~build1 i386 NX agent On the client side, I am now using X2GoClient V. 4.0.0.3 on Windows 7 (32-bit, German) Note: The problem is *independent* of the compression *settings* (it occurs with WAN/nopack as well), but it does *not* occur when bypassing X2Go and running an unaccelerated, regular X session via SSH - with the X Server "stolen" from the X2GoClient package. Also, it doesn't matter which version of the X2GoClient you use, both the interim client and the new one show this behavior in their 4.0.0.3 versions. What happens: Whenever you try to access the advanced settings/proxy settings in chromium-browser or Google Chrome, vcxsrv.exe crashes. The following problem details are given: Problemsignatur: Problemereignisname: APPCRASH Anwendungsname: vcxsrv.exe Anwendungsversion: 0.0.0.0 Anwendungszeitstempel: 4f852997 Fehlermodulname: vcxsrv.exe Fehlermodulversion: 0.0.0.0 Fehlermodulzeitstempel: 4f852997 Ausnahmecode: c0000005 Ausnahmeoffset: 00160860 Betriebsystemversion: 6.1.7601.2.1.0.768.3 Gebietsschema-ID: 1031 Zusatzinformation 1: 0a9e Zusatzinformation 2: 0a9e372d3b4ad19135b953a78882e789 Zusatzinformation 3: 0a9e Zusatzinformation 4: 0a9e372d3b4ad19135b953a78882e789 Lesen Sie unsere Datenschutzbestimmungen online: http://go.microsoft.com/fwlink/?linkid=104288&clcid=0x0407 Wenn die Onlinedatenschutzbestimmungen nicht verfügbar sind, lesen Sie unsere Datenschutzbestimmungen offline: C:\windows\system32\de-DE\erofflps.txt It would be really cool if you see to getting this fixed soon, some of my users really want to use Chrome these days. Kind Regards, Stefan

2 2

Bug#177: X2Go issue (in src:x2goclient) has been marked as pending for release
by Mike Gabriel 20 May '13

20 May '13

tag #177 pending fixed #177 4.0.1.1 thanks Hello, X2Go issue #177 (src:x2goclient) reported by you has been fixed in X2Go Git. You can see the changelog below, and you can check the diff of the fix at: http://code.x2go.org/gitweb?p=x2goclient.git;a=commitdiff;h=11af425 The issue will most likely be fixed in src:x2goclient (4.0.1.1). light+love X2Go Git Admin (on behalf of the sender of this mail) --- commit 11af425a29087773df39806844bff9744cc99182 Author: Mike Gabriel <mike.gabriel(a)das-netzwerkteam.de> Date: Mon May 20 22:20:49 2013 +0200 Use the session icon as tray icon, pop up notification bubble that informs about current session actions. (Fixes: #177). diff --git a/debian/changelog b/debian/changelog index cbd012d..1a2a82a 100644 --- a/debian/changelog +++ b/debian/changelog @@ -20,6 +20,8 @@ x2goclient (4.0.1.1-0~x2go1) UNRELEASED; urgency=low * New upstream version (4.0.1.1): - Fix detection of maximum screen area available for a session. (Fixes: #165). + - Use the session icon as tray icon, pop up notification bubble that informs + about current session actions. (Fixes: #177). [ Otto Kjell ] * New upstream version (4.0.1.1):

2 1

Bug#139: x2goclient: No keyboard input at login on OSX
by Matthew L. Dailey 20 May '13

20 May '13

Greetings, I just wanted to report that we're seeing this identical behavior, but in a slightly different way on our Mac OS X clients that are *not* running in broker mode. When we run the client, everything works well and we are able to start a session. However, if we either terminate or suspend the session, we are no longer able to enter a password in the dialog. The cursor is blinking in the password field, but no characters can be entered. All other functionality seems to work, however - other sessions can be clicked on the right side and settings of sessions can be edited. The workaround is to quit and restart the client. I had a look at the x2goclient code, and this is a bit out of my league, but something that looked suspicious to me on first glance was passForm->setEnabled() in onmainwindow.cpp. I wonder if this is getting set to false when then session runs and then not getting set back to true when the session ends or is suspended. Just a thought... Please let me know if you need any other info to help track this down. -- Matthew L. Dailey Systems Administrator Thayer School of Engineering Dartmouth College

1 0

Bug#177: New patch
by Ricardo Díaz Martín 20 May '13

20 May '13

This patch set tray icon to default x2go tray icon when a session is finished

1 0

Processed: your mail
by owner＠bugs.x2go.org 19 May '13

19 May '13

Processing commands for control(a)bugs.x2go.org: > reassign #212 x2goclient Bug #212 [<name-of-x2go-component>] x2go doesn't honour ssh (client) configuration Warning: Unknown package '<name-of-x2go-component>' Bug reassigned from package '<name-of-x2go-component>' to 'x2goclient'. No longer marked as found in versions x2goclient. Ignoring request to alter fixed versions of bug #212 to the same values previously set > found #212 4.0.1.0 Bug #212 [x2goclient] x2go doesn't honour ssh (client) configuration There is no source info for the package 'x2goclient' at version '4.0.1.0' with architecture '' Unable to make a source version for version '4.0.1.0' Marked as found in versions 4.0.1.0. > reassign #213 x2goclient Bug #213 [<name-of-x2go-component>] x2go doesn't honour /etc/ssh/ssh_known_hosts Warning: Unknown package '<name-of-x2go-component>' Bug reassigned from package '<name-of-x2go-component>' to 'x2goclient'. No longer marked as found in versions x2goclient. Ignoring request to alter fixed versions of bug #213 to the same values previously set > found #213 4.0.1.0 Bug #213 [x2goclient] x2go doesn't honour /etc/ssh/ssh_known_hosts There is no source info for the package 'x2goclient' at version '4.0.1.0' with architecture '' Unable to make a source version for version '4.0.1.0' Marked as found in versions 4.0.1.0. > thanks Stopping processing here. Please contact me if you need assistance. -- 212: http://bugs.x2go.org/cgi-bin/bugreport.cgi?bug=212 213: http://bugs.x2go.org/cgi-bin/bugreport.cgi?bug=213 X2Go Bug Tracking System Contact owner(a)bugs.x2go.org with problems

1 0

Processed: your mail
by owner＠bugs.x2go.org 19 May '13

19 May '13

Processing commands for control(a)bugs.x2go.org: > close #173 Bug #173 [x2gobroker-agent] x2gobroker-agent: missing dependency python-setproctitle Marked Bug as done > close #174 Bug #174 [x2gobroker-agent] x2gobroker-agent: missing dependency: python-paramiko Marked Bug as done > thanks Stopping processing here. Please contact me if you need assistance. -- 173: http://bugs.x2go.org/cgi-bin/bugreport.cgi?bug=173 174: http://bugs.x2go.org/cgi-bin/bugreport.cgi?bug=174 X2Go Bug Tracking System Contact owner(a)bugs.x2go.org with problems

1 0

Bug#211: X2Go issue (in src:x2gobroker) has been marked as closed
by Mike Gabriel 19 May '13

19 May '13

close #211 thanks Hello, we are very hopeful that X2Go issue #211 reported by you has been resolved in the new release (0.0.2.1) of the X2Go source project »src:x2gobroker«. You can view the complete changelog entry of src:x2gobroker (0.0.2.1) below, and you can use the following link to view all the code changes between this and the last release of src:x2gobroker. http://code.x2go.org/gitweb?p=x2gobroker.git;a=commitdiff;h=e7ba5f8e1a81d81… If you feel that the issue has not been resolved satisfyingly, feel free to reopen this bug report or submit a follow-up report with further observations described based on the new released version of src:x2gobroker. Thanks a lot for contributing to X2Go!!! light+love X2Go Git Admin (on behalf of the sender of this mail) --- X2Go Component: src:x2gobroker Version: 0.0.2.1 Status: RELEASE Date: Sun, 19 May 2013 12:41:06 +0200 Fixes: 201 210 211 Changes: x2gobroker (0.0.2.1) RELEASED; urgency=low . [ Mike Gabriel ] * New upstream version (0.0.2.1): - Remove trailing slashes from ManagementServer URLs. - In Apache2 vhost configuration example, move WSGI environment variable settings into VirtualHost setup. - Remove unused, not-yet-developed broker backends and frontends. - Remove old cruft from x2gobroker.conf. - Security fix for setuid wrapper x2gobroker-agent.c. Hard-code path to x2gobroker-agent.pl during build via defining a macro in the Makefile. Thanks to Richard Weinberger for spotting this!!! - Handle URLs in plain WebUI that have slashes (and subpaths) in the backend name. - In WSGI mode: only populate os.environ with variables matching »X2GOBROKER_*«. - Make X2GOBROKER_SESSIONPROFILES configurable via a SetEnv WSGI parameter in the httpd configuration possible. (Fixes: #210). * Provide init scripts and *.default files outside of /debian folder (as they are also relevant for non-Debian packaging). . [ Jan Engelhardt ] * New upstream version (0.0.2.1): - Populate install target of Makefile. (Fixes: #201). - Install man pages and default files through Makefile, as well. (Fixes: #211).

2 1

← Newer
1
2
3
4
5
6
7
8
9
10
Older →

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

x2go-dev May 2013