x2go-dev February 2015

x2go-dev@lists.x2go.org

28 participants
202 discussions

Re: [X2Go-Dev] Fixes for 2011-2014 X.org CVEs and potential regressions in nx-libs
by Mike DePaulo 15 Feb '15

15 Feb '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On Sat, Feb 14, 2015 at 12:43 PM, Mike DePaulo <mikedep333(a)gmail.com> wrote: > ... > https://docs.google.com/spreadsheets/d/1WeneRYO2TkXYOl5J0WozThsLkreF1DiuJAv… > > > ... > > Also, note that by default, X2GO launches nxagent (the nx-libs X > server) with "-nolisten tcp". This is configurable in > /etc/x2go/x2goagent.options . This setting mitigates many of the > vulnerabilities by preventing nxagent from ever talking to X11 > clients not running on the X2Go Server. I will now be determining > which vulnerabilities it does mitigate. Most CVEs are mitigated by "-nolisten TCP", or are N/A because the CVEs can only be exploited by local X11 clients (X11 applications) anyway. "-nolisten TCP" is especially important for mitigating CVE-2014-8091 because an X11 client need not be authenticated to exploit it. An exploit would result in nxagent (and thus your X2Go session) crashing. (In layman's terms, unless you kept "-nolisten TCP" set, someone on the network can crash every X2Go session running on an X2Go server.) 2 CVEs are not mitigated by "-nolisten TCP": 2014-0210 CVE-2014-0211 A malicious remote X Font Server can trigger these vulnerabilities, even when the X11 clients are running locally on the X2Go server. - -Mike#2 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iF4EAREIAAYFAlTgn+8ACgkQIFy22CVQsitHFwD/X2v6kUmf1+vVGbG5gvYMAT7d YlZ5Ks62wwK6eSutNR0BAJAI7H83e8TBtIc3vs0OIZamn3tCfBwJ3WZsjwOWT7WC =eykp -----END PGP SIGNATURE-----

1 0

Fixes for 2011-2014 X.org CVEs and potential regressions in nx-libs
by Mike DePaulo 14 Feb '15

14 Feb '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hello X2Go Developers, Over the last few weeks, I have been auditing nx-libs against all the vulnerabilities (CVEs) in X.org 6.9.0. nx-libs 3.5.0 (released by NoMachine in 2011) contains a fork of X.org 6.9.0 (released in December 2005). So our concern was that a large percentage of the X.org vulnerabilities announced since X.org 6.9.0 affect nx-libs. I wrote a spreadsheet with the results of my audit here. Note that I have not actually tested whether the vulnerabilities affect us. For example, I have not tried out any proof-of-concept exploits. But if the vulnerable code is present, and the vulnerable code is not totally ignored by nx-libs, then I assumed that the vulnerability affects nx-libs. The only exception is CVE-2013-1940; I inferred that it does not affect us because it only affects VT switching on Linux, and nx-libs does not use VTs. https://docs.google.com/spreadsheets/d/1WeneRYO2TkXYOl5J0WozThsLkreF1DiuJAv… To summarize the results: 1. Some vulnerabilities do not affect us for various reasons. Often because the code was removed by NoMachine. 2. NoMachine did a very good job of patching the vulnerabilities. The earliest vulnerability that was unpatched, CVE-2011-2895, was announced on 2011-08-10. 3. The majority of the vulnerabilities after 2011-08-10 did affect nx-libs 3.5.0.x and nx-libs 3.6.x. I fixed these and the fixes are now in git. See details below. As I audited nx-libs, I fixed each vulnerability. Before the December 2014 vulnerabilities, I backported the commit/patch from upstream X.org. For the December 2014 vulnerabilities, which were numerous and whose patches/commits were hard to merge, I obtained the patches from RHEL5 instead. RHEL 5 uses X.org 7.1 (xorg-server 1.1.1), so their patches were easier to apply to nx-libs. I am a beginner at programming in C. So I asked Mike#1 (Mike Gabriel) to review my work. He did, and did not find any issues. I still welcome further review though. Mike#1 committed my work to the 3.6.x branch: 1st commit: http://code.x2go.org/gitweb?p=nx-libs.git;a=commit;h=af55da1e9c1a6a352b2482… last (40th) commit: http://code.x2go.org/gitweb?p=nx-libs.git;a=commit;h=1ea1cd8c4f93b0c03e5b34… He also committed it to the 3.5.0.x branch as one commit with 40 patch files: http://code.x2go.org/gitweb?p=nx-libs.git;a=commitdiff;h=4587881130db36125c… However, because many lines of code have been changed, Mike#1 and I agreed that we will not release 3.5.0.29 with these fixes immediately. Instead, we will let users/developers do some testing to see if any regressions were introduced. Also, note that by default, X2GO launches nxagent (the nx-libs X server) with "-nolisten tcp". This is configurable in /etc/x2go/x2goagent.options . This setting mitigates many of the vulnerabilities by preventing nxagent from ever talking to X11 clients not running on the X2Go Server. I will now be determining which vulnerabilities it does mitigate. - -Mike#2 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iF4EAREIAAYFAlTfiSUACgkQIFy22CVQsitDXAEAlte83RMq3iy218Q7zXggAb0R XpvCpQYOYnaZenHPqQsBAMVfH8olUE1mh6DNfTgeC2909c1t4JDAjx3pSEdSDdL5 =mUvD -----END PGP SIGNATURE-----

1 0

Bug#785: 785
by Sergey Savko 13 Feb '15

13 Feb '15

Yes, it's work. Thank you. This bug does not appear after turning on this option? https://bugs.launchpad.net/ubuntu/+source/libxrandr/+bug/985202 ----- Исходное сообщение ----- От: "Ulrich Sibiller" <uli42(a)gmx.de> Кому: "Sergey Savko" <savko(a)tophouse.ru> Отправленные: Пятница, 13 Февраль 2015 г 0:27:55 Тема: Re: 785 Ok, please enable the XFIXES extension. This can be done in /etc/x2go/x2goagent.options Ensure that you find +extension XFIXES in there: X2GO_NXAGENT_DEFAULT_OPTIONS+=" +extension XFIXES" Uli On Thu, Feb 12, 2015 at 9:33 PM, Sergey Savko <savko(a)tophouse.ru> wrote: > Versions x2goclient > Windows x2goclient 4.0.3.1 > Linux x2goclient: > $ apt-show-versions | grep x2goclient > x2goclient 4.0.3.2-0x2go1 newer than version in archive > nx-libs 3.5.0.29-0 > > $xdpyinfo > > name of display: :50 > version number: 11.0 > vendor string: The X.Org Foundation > vendor release number: 70000000 > X.Org version: 7.0.0 > maximum request size: 16777212 bytes > motion buffer size: 256 > bitmap unit, bit order, padding: 32, LSBFirst, 32 > image byte order: LSBFirst > number of supported pixmap formats: 7 > supported pixmap formats: > depth 1, bits_per_pixel 1, scanline_pad 32 > depth 4, bits_per_pixel 8, scanline_pad 32 > depth 8, bits_per_pixel 8, scanline_pad 32 > depth 15, bits_per_pixel 16, scanline_pad 32 > depth 16, bits_per_pixel 16, scanline_pad 32 > depth 24, bits_per_pixel 32, scanline_pad 32 > depth 32, bits_per_pixel 32, scanline_pad 32 > keycode range: minimum 8, maximum 255 > focus: window 0x1000018, revert to PointerRoot > number of extensions: 26 > BIG-REQUESTS > DAMAGE > DEC-XTRAP > DOUBLE-BUFFER > DPMS > Extended-Visual-Information > GLX > MIT-SHM > MIT-SUNDRY-NONSTANDARD > RANDR > RECORD > RENDER > SECURITY > SGI-GLX > SHAPE > SYNC > TOG-CUP > X-Resource > XC-APPGROUP > XC-MISC > XFree86-Bigfont > XINERAMA > XInputExtension > XKEYBOARD > XTEST > XVideo > default screen number: 0 > number of screens: 1 > > screen #0: > dimensions: 1920x1087 pixels (508x288 millimeters) > resolution: 96x96 dots per inch > depths (7): 24, 1, 4, 8, 15, 16, 32 > root window id: 0x59 > depth of root window: 24 planes > number of colormaps: minimum 1, maximum 1 > default colormap: 0x3f > default number of colormap cells: 256 > preallocated pixels: black 0, white 16777215 > options: backing-store YES, save-unders YES > largest cursor: 1920x1087 > current input event mask: 0xfac031 > KeyPressMask EnterWindowMask LeaveWindowMask > KeymapStateMask ExposureMask StructureNotifyMask > SubstructureNotifyMask SubstructureRedirectMask FocusChangeMask > PropertyChangeMask ColormapChangeMask > number of visuals: 5 > default visual id: 0x3a > visual: > visual id: 0x3a > class: TrueColor > depth: 24 planes > available colormap entries: 256 per subfield > red, green, blue masks: 0xff0000, 0xff00, 0xff > significant bits in color specification: 8 bits > visual: > visual id: 0x3b > class: TrueColor > depth: 24 planes > available colormap entries: 256 per subfield > red, green, blue masks: 0xff0000, 0xff00, 0xff > significant bits in color specification: 8 bits > visual: > visual id: 0x3c > class: TrueColor > depth: 24 planes > available colormap entries: 256 per subfield > red, green, blue masks: 0xff0000, 0xff00, 0xff > significant bits in color specification: 8 bits > visual: > visual id: 0x3d > class: TrueColor > depth: 24 planes > available colormap entries: 256 per subfield > red, green, blue masks: 0xff0000, 0xff00, 0xff > significant bits in color specification: 8 bits > visual: > visual id: 0x3e > class: StaticColor > depth: 24 planes > available colormap entries: 256 > red, green, blue masks: 0xff0000, 0xff00, 0xff > significant bits in color specification: 8 bits > > > ----- Исходное сообщение ----- > От: "Ulrich Sibiller" <uli42(a)gmx.de> > Кому: "Sergey Savko" <savko(a)tophouse.ru> > Отправленные: Четверг, 12 Февраль 2015 г 22:54:35 > Тема: Re: 785 > > On Thu, Feb 12, 2015 at 4:02 PM, Sergey Savko <savko(a)tophouse.ru> wrote: >> I tested with lastest nx-libs. Bug is present. >> Last video with this bug: http://youtu.be/QTk1G1jLT-I > > Hmm, interesting. > > I suspect that your client is too old. What is it's version? What > nx-libs are included there? > > And please post the output of xdpyinfo in your session. > > Uli > > -- > Yours truly, > Sergey Savko. -- С уважением, Сергей Савко, начальник IT отдела. +7-931-361-04-02

2 2

Bug#785: 785
by Sergey Savko 12 Feb '15

12 Feb '15

I tested with lastest nx-libs. Bug is present. Last video with this bug: http://youtu.be/QTk1G1jLT-I -- Yours truly, Sergey Savko.

1 0

Bug#785: Bug#785: Bug#785: x2go clipboard bug
by Sergey Savko 11 Feb '15

11 Feb '15

To be precise it's not quite FreeNX. This patched FreeNX, called the RX from the company etersoft. Tomorrow I will try to update and test. -- Yours truly, Sergey Savko. ----- Исходное сообщение ----- От: "Ulrich Sibiller" <uli42(a)gmx.de> Кому: "Sergey Savko" <savko(a)tophouse.ru> Отправленные: Четверг, 12 Февраль 2015 г 0:34:29 Тема: Re: [X2Go-Dev] Bug#785: Bug#785: x2go clipboard bug So then try a newer x2go version. You should ensure that nx-libs is 3.5.0.28. Regarding FreeNX: I am pretty sure nx 3.4.0 did not have that clipboard problem I fixed in 3.5.0.28. Uli

1 0

Bug#785: x2go clipboard bug
by Sergey Savko 11 Feb '15

11 Feb '15

Package: x2goclient Version: 4.0.3.2 Severity: normal x2goclient doesnt work with clipboard properly. When you copy a file to clipboard and closed a source directory its just disapear from clipboard . It's with plain text also. When you copy to clipboard a part of a text from text document and then closed a text editor, the clipboard will be empty. -- Yours truly, Sergey Savko.

4 5

Re: [X2Go-Dev] CUPS-X2Go (3.0.1.1) released
by Orion Poplawski 11 Feb '15

11 Feb '15

On 02/10/2015 01:24 PM, Mihai Moldovan wrote: > Dear all > > The X2Go project is proud to announce a new release of the X2Go > component ,,cups-x2go''. > > New gains of this version of ,,cups-x2go'' are: > > o better RPM package support > > > X2Go Component: cups-x2go > Version: 3.0.1.1 > Status: RELEASE > Date: Tue, 10 Feb 2015 20:03:16 +0100 > Changes: > cups-x2go (3.0.1.1) RELEASED; urgency=low > . > [ Mike Gabriel ] > * New upstream version (3.0.1.1): > - Rename LICENSE.txt to COPYING. > * cups-x2go.spec: > + Pull-in packaging stuff from Jan Engelhardt's .spec files > on > https://build.opensuse.org/package/view_file/X11:RemoteDesktop:x2go. > + Make package arch-any, not noarch. I don't understand the reason for this change, it seems clearly to be a noarch package. Also, FYI: - on Fedora ssh is in openssh-clients. - cups backends go in %{_prefix}/lib, not %_libexecdir - You install the cups-x2go with 755: install -pm755 cups-x2go %{buildroot}%{_prefix}/lib/cups/backend/ then change it to 700 in %files: %attr(0700,root,root) %_libexecdir/cups/backend/cups-x2go Is there any reason for it to be 700? I see other stuff in that directory is a mix: -rwxr-xr-x. 1 root root 149216 Sep 23 06:37 bluetooth -rwx------. 1 root root 23648 Oct 22 03:30 dnssd - I have no idea about non-Fedora/RHEL distros, but %defattr() is no longer needed for any modern (RHEL5+) rpm systems. - Alsi, in Fedora, you should not own directories own by other packages that it requires. I have: %files %doc ChangeLog COPYING README.txt %{_prefix}/lib/cups/backend/cups-x2go %config(noreplace) %{_sysconfdir}/cups/cups-x2go.conf %{_datadir}/ppd/cups-x2go/ %{_datadir}/x2go/ -- Orion Poplawski Technical Manager 303-415-9701 x222 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 http://www.nwra.com

3 6

Bug#787: x2goclient
by Sergey Savko 11 Feb '15

11 Feb '15

Package: x2goclient Version: 4.0.3.2 Severity: normal Windows x2goclient crashes when connecting to server if user's home directory name in cyrillic. If we use "--home=<dir>" parametr with new home directory with latin name, x2goclient works fine. -- Yours truly, Sergey Savko.

1 0

Bug#785: 785
by Sergey Savko 11 Feb '15

11 Feb '15

Clipboard in local Debian 7 and Kubuntu 14.04 it's work too. -- Yours truly, Sergey Savko.

1 0

Bug#786: x2goclient copy cyrillic text from x2go to local linux
by Sergey Savko 11 Feb '15

11 Feb '15

Package: x2goclient Version: 4.0.3.2 Severity: normal If you copy in x2go Cyrillic text and paste it into local Linux, you'll get text in wrong codepage. -- Yours truly, Sergey Savko.

1 0

← Newer
1
...
14
15
16
17
18
19
20
21
Older →

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

x2go-dev February 2015