x2go-dev

x2go-dev@lists.x2go.org

5400 discussions

Re: [X2Go-Dev] Fixes for 2011-2014 X.org CVEs and potential regressions in nx-libs
by Michael DePaulo 15 Feb '15

15 Feb '15

2015-02-15 8:31 GMT-05:00 Mike DePaulo <mikedep333(a)gmail.com>: > bQBuWYZZrHSq5sOQcsDIQWu+r/7qcjvr+dyRT+OpvosVpZFpWXshb9a7gEBqB85/ Sorry, please ignore that email. I told ThunderBird with the EnigMail extension to send the email about CVEs being mitigated by "-nolisten TCP" twice because the 1st time produced an error message. For whatever reason, the 1st time it was sent, but it was sent encrypted. The 2nd time, it was sent successfully, and was signed.

1 0

Re: [X2Go-Dev] Fixes for 2011-2014 X.org CVEs and potential regressions in nx-libs
by Mike DePaulo 15 Feb '15

15 Feb '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 On Sat, Feb 14, 2015 at 12:43 PM, Mike DePaulo <mikedep333(a)gmail.com> wrote: > ... > https://docs.google.com/spreadsheets/d/1WeneRYO2TkXYOl5J0WozThsLkreF1DiuJAv… > > > ... > > Also, note that by default, X2GO launches nxagent (the nx-libs X > server) with "-nolisten tcp". This is configurable in > /etc/x2go/x2goagent.options . This setting mitigates many of the > vulnerabilities by preventing nxagent from ever talking to X11 > clients not running on the X2Go Server. I will now be determining > which vulnerabilities it does mitigate. Most CVEs are mitigated by "-nolisten TCP", or are N/A because the CVEs can only be exploited by local X11 clients (X11 applications) anyway. "-nolisten TCP" is especially important for mitigating CVE-2014-8091 because an X11 client need not be authenticated to exploit it. An exploit would result in nxagent (and thus your X2Go session) crashing. (In layman's terms, unless you kept "-nolisten TCP" set, someone on the network can crash every X2Go session running on an X2Go server.) 2 CVEs are not mitigated by "-nolisten TCP": 2014-0210 CVE-2014-0211 A malicious remote X Font Server can trigger these vulnerabilities, even when the X11 clients are running locally on the X2Go server. - -Mike#2 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iF4EAREIAAYFAlTgn+8ACgkQIFy22CVQsitHFwD/X2v6kUmf1+vVGbG5gvYMAT7d YlZ5Ks62wwK6eSutNR0BAJAI7H83e8TBtIc3vs0OIZamn3tCfBwJ3WZsjwOWT7WC =eykp -----END PGP SIGNATURE-----

1 0

Fixes for 2011-2014 X.org CVEs and potential regressions in nx-libs
by Mike DePaulo 14 Feb '15

14 Feb '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Hello X2Go Developers, Over the last few weeks, I have been auditing nx-libs against all the vulnerabilities (CVEs) in X.org 6.9.0. nx-libs 3.5.0 (released by NoMachine in 2011) contains a fork of X.org 6.9.0 (released in December 2005). So our concern was that a large percentage of the X.org vulnerabilities announced since X.org 6.9.0 affect nx-libs. I wrote a spreadsheet with the results of my audit here. Note that I have not actually tested whether the vulnerabilities affect us. For example, I have not tried out any proof-of-concept exploits. But if the vulnerable code is present, and the vulnerable code is not totally ignored by nx-libs, then I assumed that the vulnerability affects nx-libs. The only exception is CVE-2013-1940; I inferred that it does not affect us because it only affects VT switching on Linux, and nx-libs does not use VTs. https://docs.google.com/spreadsheets/d/1WeneRYO2TkXYOl5J0WozThsLkreF1DiuJAv… To summarize the results: 1. Some vulnerabilities do not affect us for various reasons. Often because the code was removed by NoMachine. 2. NoMachine did a very good job of patching the vulnerabilities. The earliest vulnerability that was unpatched, CVE-2011-2895, was announced on 2011-08-10. 3. The majority of the vulnerabilities after 2011-08-10 did affect nx-libs 3.5.0.x and nx-libs 3.6.x. I fixed these and the fixes are now in git. See details below. As I audited nx-libs, I fixed each vulnerability. Before the December 2014 vulnerabilities, I backported the commit/patch from upstream X.org. For the December 2014 vulnerabilities, which were numerous and whose patches/commits were hard to merge, I obtained the patches from RHEL5 instead. RHEL 5 uses X.org 7.1 (xorg-server 1.1.1), so their patches were easier to apply to nx-libs. I am a beginner at programming in C. So I asked Mike#1 (Mike Gabriel) to review my work. He did, and did not find any issues. I still welcome further review though. Mike#1 committed my work to the 3.6.x branch: 1st commit: http://code.x2go.org/gitweb?p=nx-libs.git;a=commit;h=af55da1e9c1a6a352b2482… last (40th) commit: http://code.x2go.org/gitweb?p=nx-libs.git;a=commit;h=1ea1cd8c4f93b0c03e5b34… He also committed it to the 3.5.0.x branch as one commit with 40 patch files: http://code.x2go.org/gitweb?p=nx-libs.git;a=commitdiff;h=4587881130db36125c… However, because many lines of code have been changed, Mike#1 and I agreed that we will not release 3.5.0.29 with these fixes immediately. Instead, we will let users/developers do some testing to see if any regressions were introduced. Also, note that by default, X2GO launches nxagent (the nx-libs X server) with "-nolisten tcp". This is configurable in /etc/x2go/x2goagent.options . This setting mitigates many of the vulnerabilities by preventing nxagent from ever talking to X11 clients not running on the X2Go Server. I will now be determining which vulnerabilities it does mitigate. - -Mike#2 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iF4EAREIAAYFAlTfiSUACgkQIFy22CVQsitDXAEAlte83RMq3iy218Q7zXggAb0R XpvCpQYOYnaZenHPqQsBAMVfH8olUE1mh6DNfTgeC2909c1t4JDAjx3pSEdSDdL5 =mUvD -----END PGP SIGNATURE-----

1 0

Bug#785: 785
by Sergey Savko 13 Feb '15

13 Feb '15

Yes, it's work. Thank you. This bug does not appear after turning on this option? https://bugs.launchpad.net/ubuntu/+source/libxrandr/+bug/985202 ----- Исходное сообщение ----- От: "Ulrich Sibiller" <uli42(a)gmx.de> Кому: "Sergey Savko" <savko(a)tophouse.ru> Отправленные: Пятница, 13 Февраль 2015 г 0:27:55 Тема: Re: 785 Ok, please enable the XFIXES extension. This can be done in /etc/x2go/x2goagent.options Ensure that you find +extension XFIXES in there: X2GO_NXAGENT_DEFAULT_OPTIONS+=" +extension XFIXES" Uli On Thu, Feb 12, 2015 at 9:33 PM, Sergey Savko <savko(a)tophouse.ru> wrote: > Versions x2goclient > Windows x2goclient 4.0.3.1 > Linux x2goclient: > $ apt-show-versions | grep x2goclient > x2goclient 4.0.3.2-0x2go1 newer than version in archive > nx-libs 3.5.0.29-0 > > $xdpyinfo > > name of display: :50 > version number: 11.0 > vendor string: The X.Org Foundation > vendor release number: 70000000 > X.Org version: 7.0.0 > maximum request size: 16777212 bytes > motion buffer size: 256 > bitmap unit, bit order, padding: 32, LSBFirst, 32 > image byte order: LSBFirst > number of supported pixmap formats: 7 > supported pixmap formats: > depth 1, bits_per_pixel 1, scanline_pad 32 > depth 4, bits_per_pixel 8, scanline_pad 32 > depth 8, bits_per_pixel 8, scanline_pad 32 > depth 15, bits_per_pixel 16, scanline_pad 32 > depth 16, bits_per_pixel 16, scanline_pad 32 > depth 24, bits_per_pixel 32, scanline_pad 32 > depth 32, bits_per_pixel 32, scanline_pad 32 > keycode range: minimum 8, maximum 255 > focus: window 0x1000018, revert to PointerRoot > number of extensions: 26 > BIG-REQUESTS > DAMAGE > DEC-XTRAP > DOUBLE-BUFFER > DPMS > Extended-Visual-Information > GLX > MIT-SHM > MIT-SUNDRY-NONSTANDARD > RANDR > RECORD > RENDER > SECURITY > SGI-GLX > SHAPE > SYNC > TOG-CUP > X-Resource > XC-APPGROUP > XC-MISC > XFree86-Bigfont > XINERAMA > XInputExtension > XKEYBOARD > XTEST > XVideo > default screen number: 0 > number of screens: 1 > > screen #0: > dimensions: 1920x1087 pixels (508x288 millimeters) > resolution: 96x96 dots per inch > depths (7): 24, 1, 4, 8, 15, 16, 32 > root window id: 0x59 > depth of root window: 24 planes > number of colormaps: minimum 1, maximum 1 > default colormap: 0x3f > default number of colormap cells: 256 > preallocated pixels: black 0, white 16777215 > options: backing-store YES, save-unders YES > largest cursor: 1920x1087 > current input event mask: 0xfac031 > KeyPressMask EnterWindowMask LeaveWindowMask > KeymapStateMask ExposureMask StructureNotifyMask > SubstructureNotifyMask SubstructureRedirectMask FocusChangeMask > PropertyChangeMask ColormapChangeMask > number of visuals: 5 > default visual id: 0x3a > visual: > visual id: 0x3a > class: TrueColor > depth: 24 planes > available colormap entries: 256 per subfield > red, green, blue masks: 0xff0000, 0xff00, 0xff > significant bits in color specification: 8 bits > visual: > visual id: 0x3b > class: TrueColor > depth: 24 planes > available colormap entries: 256 per subfield > red, green, blue masks: 0xff0000, 0xff00, 0xff > significant bits in color specification: 8 bits > visual: > visual id: 0x3c > class: TrueColor > depth: 24 planes > available colormap entries: 256 per subfield > red, green, blue masks: 0xff0000, 0xff00, 0xff > significant bits in color specification: 8 bits > visual: > visual id: 0x3d > class: TrueColor > depth: 24 planes > available colormap entries: 256 per subfield > red, green, blue masks: 0xff0000, 0xff00, 0xff > significant bits in color specification: 8 bits > visual: > visual id: 0x3e > class: StaticColor > depth: 24 planes > available colormap entries: 256 > red, green, blue masks: 0xff0000, 0xff00, 0xff > significant bits in color specification: 8 bits > > > ----- Исходное сообщение ----- > От: "Ulrich Sibiller" <uli42(a)gmx.de> > Кому: "Sergey Savko" <savko(a)tophouse.ru> > Отправленные: Четверг, 12 Февраль 2015 г 22:54:35 > Тема: Re: 785 > > On Thu, Feb 12, 2015 at 4:02 PM, Sergey Savko <savko(a)tophouse.ru> wrote: >> I tested with lastest nx-libs. Bug is present. >> Last video with this bug: http://youtu.be/QTk1G1jLT-I > > Hmm, interesting. > > I suspect that your client is too old. What is it's version? What > nx-libs are included there? > > And please post the output of xdpyinfo in your session. > > Uli > > -- > Yours truly, > Sergey Savko. -- С уважением, Сергей Савко, начальник IT отдела. +7-931-361-04-02

2 2

Bug#785: 785
by Sergey Savko 12 Feb '15

12 Feb '15

I tested with lastest nx-libs. Bug is present. Last video with this bug: http://youtu.be/QTk1G1jLT-I -- Yours truly, Sergey Savko.

1 0

Bug#785: Bug#785: Bug#785: x2go clipboard bug
by Sergey Savko 11 Feb '15

11 Feb '15

To be precise it's not quite FreeNX. This patched FreeNX, called the RX from the company etersoft. Tomorrow I will try to update and test. -- Yours truly, Sergey Savko. ----- Исходное сообщение ----- От: "Ulrich Sibiller" <uli42(a)gmx.de> Кому: "Sergey Savko" <savko(a)tophouse.ru> Отправленные: Четверг, 12 Февраль 2015 г 0:34:29 Тема: Re: [X2Go-Dev] Bug#785: Bug#785: x2go clipboard bug So then try a newer x2go version. You should ensure that nx-libs is 3.5.0.28. Regarding FreeNX: I am pretty sure nx 3.4.0 did not have that clipboard problem I fixed in 3.5.0.28. Uli

1 0

Bug#785: x2go clipboard bug
by Sergey Savko 11 Feb '15

11 Feb '15

Package: x2goclient Version: 4.0.3.2 Severity: normal x2goclient doesnt work with clipboard properly. When you copy a file to clipboard and closed a source directory its just disapear from clipboard . It's with plain text also. When you copy to clipboard a part of a text from text document and then closed a text editor, the clipboard will be empty. -- Yours truly, Sergey Savko.

4 5

Re: [X2Go-Dev] CUPS-X2Go (3.0.1.1) released
by Orion Poplawski 11 Feb '15

11 Feb '15

On 02/10/2015 01:24 PM, Mihai Moldovan wrote: > Dear all > > The X2Go project is proud to announce a new release of the X2Go > component ,,cups-x2go''. > > New gains of this version of ,,cups-x2go'' are: > > o better RPM package support > > > X2Go Component: cups-x2go > Version: 3.0.1.1 > Status: RELEASE > Date: Tue, 10 Feb 2015 20:03:16 +0100 > Changes: > cups-x2go (3.0.1.1) RELEASED; urgency=low > . > [ Mike Gabriel ] > * New upstream version (3.0.1.1): > - Rename LICENSE.txt to COPYING. > * cups-x2go.spec: > + Pull-in packaging stuff from Jan Engelhardt's .spec files > on > https://build.opensuse.org/package/view_file/X11:RemoteDesktop:x2go. > + Make package arch-any, not noarch. I don't understand the reason for this change, it seems clearly to be a noarch package. Also, FYI: - on Fedora ssh is in openssh-clients. - cups backends go in %{_prefix}/lib, not %_libexecdir - You install the cups-x2go with 755: install -pm755 cups-x2go %{buildroot}%{_prefix}/lib/cups/backend/ then change it to 700 in %files: %attr(0700,root,root) %_libexecdir/cups/backend/cups-x2go Is there any reason for it to be 700? I see other stuff in that directory is a mix: -rwxr-xr-x. 1 root root 149216 Sep 23 06:37 bluetooth -rwx------. 1 root root 23648 Oct 22 03:30 dnssd - I have no idea about non-Fedora/RHEL distros, but %defattr() is no longer needed for any modern (RHEL5+) rpm systems. - Alsi, in Fedora, you should not own directories own by other packages that it requires. I have: %files %doc ChangeLog COPYING README.txt %{_prefix}/lib/cups/backend/cups-x2go %config(noreplace) %{_sysconfdir}/cups/cups-x2go.conf %{_datadir}/ppd/cups-x2go/ %{_datadir}/x2go/ -- Orion Poplawski Technical Manager 303-415-9701 x222 NWRA, Boulder/CoRA Office FAX: 303-415-9702 3380 Mitchell Lane orion(a)nwra.com Boulder, CO 80301 http://www.nwra.com

3 6

Bug#787: x2goclient
by Sergey Savko 11 Feb '15

11 Feb '15

Package: x2goclient Version: 4.0.3.2 Severity: normal Windows x2goclient crashes when connecting to server if user's home directory name in cyrillic. If we use "--home=<dir>" parametr with new home directory with latin name, x2goclient works fine. -- Yours truly, Sergey Savko.

1 0

Bug#785: 785
by Sergey Savko 11 Feb '15

11 Feb '15

Clipboard in local Debian 7 and Kubuntu 14.04 it's work too. -- Yours truly, Sergey Savko.

1 0

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

x2go-dev