Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.security > #5699 > unrolled thread

various security issues in VNC related packages

Started byMike Gabriel <mike.gabriel@das-netzwerkteam.de>
First post2019-10-30 16:20 +0100
Last post2019-11-04 10:30 +0100
Articles 5 — 2 participants

Back to article view | Back to linux.debian.security

Contents

  various security issues in VNC related packages Mike Gabriel <mike.gabriel@das-netzwerkteam.de> - 2019-10-30 16:20 +0100
    Re: various security issues in VNC related packages Ola Lundqvist <ola@inguza.com> - 2019-10-30 21:40 +0100
      Re: various security issues in VNC related packages Mike Gabriel <mike.gabriel@das-netzwerkteam.de> - 2019-10-31 09:00 +0100
        Re: various security issues in VNC related packages Ola Lundqvist <ola@inguza.com> - 2019-11-04 10:20 +0100
          Re: various security issues in VNC related packages Mike Gabriel <mike.gabriel@das-netzwerkteam.de> - 2019-11-04 10:30 +0100

#5699 — various security issues in VNC related packages

FromMike Gabriel <mike.gabriel@das-netzwerkteam.de>
Date2019-10-30 16:20 +0100
Subjectvarious security issues in VNC related packages
Message-ID<yWXVn-7Sl-5@gated-at.bofh.it>

[Multipart message — attachments visible in raw view] — view raw

Hi all,

today I looked into libvncserver/CVE-2019-15681. The VNC situation is  
non-optimal in Debian...

The gist (which also applies to Debian) can be found in [1]. Thanks to  
Pavel Cheremushkin from Kaspersky for publishing his findings.

I looked at all packages I could think of that are related to VNC and  
came up with this list:

   x11vnc -> uses system's libvncserver and system's libvncclient, but still
             bundles older versions of both in the orig tarball. (See [2]).
             NOT AFFECTED

   italc  -> bundles libvncserver (shame on myself+upstream) and uses it. It
             probably needs to be listed for all libvncserver CVEs we have seen
             in the past (luckily italc has been removed from unstable recently
             and replaced by veyon)
             AFFECTED (LOVE NEEDED)

   krfb   -> ships rfbserver.c from libvncserver, but uses its own  
implementation
             of an rfbserver rewritten in C++/Qt
             NOT AFFECTED

   ssvnc  -> VNC client only; ships libvncclient code files, probably  
affected by
             all libvncclient CVEs
             NEEDS MORE TRIAGING

   veyon  -> uses system-wide libvncserver, but still bundles libvncclient
             (this will be resolved with veyon 4.3.0, I heard from upstream)
             NEEDS MORE TRIAGING

   vino   -> bundles libvncserver and uses it. It probably needs to
             be listed for all libvncserver CVEs we have seen in the past
             AFFECTED (LOVE NEEDED)

   vncsnapshot -> contains a small subset the libvncclient files
             NEEDS MORE TRIAGING

   tightvnc -> has copy+pasted code from libvncserver, e.g. rfbserver.(ch)
             and also from libvncclient
             PARTIALLY AFFECTED (LOVE NEEDED)

   tigervnc -> VNC code has been entirely rewritten in C++, not related
               to libvncserver / libvncclient (anymore?) as it seems

Please add more packages, if you see fit, that belong to the same  
category of packages. Please provide feedback if you think otherwise  
on statements I made above.

light+love
Mike

[1] https://www.openwall.com/lists/oss-security/2018/12/10/5
[2] https://bugs.debian.org/943833
-- 

DAS-NETZWERKTEAM
c\o Technik- und Ökologiezentrum Eckernförde
Mike Gabriel, Marienthaler str. 17, 24340 Eckernförde
mobile: +49 (1520) 1976 148
landline: +49 (4351) 850 8940

GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22  0782 9AF4 6B30 2577 1B31
mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de

[toc] | [next] | [standalone]

#5700

FromOla Lundqvist <ola@inguza.com>
Date2019-10-30 21:40 +0100
Message-ID<yX2V4-2qE-5@gated-at.bofh.it>
In reply to#5699

[Multipart message — attachments visible in raw view] — view raw

Hi

I agree that the VNC situation in Debian is sub-optimal. Frankly speaking
not just in Debian. This popular software has diverged quite a lot with lot
of packages sharing similar code-base.

I had a brief look at vnc4 as well. It does not seem to share the same code
base as libvncserver so it should not be affected.

Best regards

// Ola

On Wed, 30 Oct 2019 at 16:10, Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
wrote:

> Hi all,
>
> today I looked into libvncserver/CVE-2019-15681. The VNC situation is
> non-optimal in Debian...
>
> The gist (which also applies to Debian) can be found in [1]. Thanks to
> Pavel Cheremushkin from Kaspersky for publishing his findings.
>
> I looked at all packages I could think of that are related to VNC and
> came up with this list:
>
>    x11vnc -> uses system's libvncserver and system's libvncclient, but
> still
>              bundles older versions of both in the orig tarball. (See [2]).
>              NOT AFFECTED
>
>    italc  -> bundles libvncserver (shame on myself+upstream) and uses it.
> It
>              probably needs to be listed for all libvncserver CVEs we have
> seen
>              in the past (luckily italc has been removed from unstable
> recently
>              and replaced by veyon)
>              AFFECTED (LOVE NEEDED)
>
>    krfb   -> ships rfbserver.c from libvncserver, but uses its own
> implementation
>              of an rfbserver rewritten in C++/Qt
>              NOT AFFECTED
>
>    ssvnc  -> VNC client only; ships libvncclient code files, probably
> affected by
>              all libvncclient CVEs
>              NEEDS MORE TRIAGING
>
>    veyon  -> uses system-wide libvncserver, but still bundles libvncclient
>              (this will be resolved with veyon 4.3.0, I heard from
> upstream)
>              NEEDS MORE TRIAGING
>
>    vino   -> bundles libvncserver and uses it. It probably needs to
>              be listed for all libvncserver CVEs we have seen in the past
>              AFFECTED (LOVE NEEDED)
>
>    vncsnapshot -> contains a small subset the libvncclient files
>              NEEDS MORE TRIAGING
>
>    tightvnc -> has copy+pasted code from libvncserver, e.g. rfbserver.(ch)
>              and also from libvncclient
>              PARTIALLY AFFECTED (LOVE NEEDED)
>
>    tigervnc -> VNC code has been entirely rewritten in C++, not related
>                to libvncserver / libvncclient (anymore?) as it seems
>
> Please add more packages, if you see fit, that belong to the same
> category of packages. Please provide feedback if you think otherwise
> on statements I made above.
>
> light+love
> Mike
>
> [1] https://www.openwall.com/lists/oss-security/2018/12/10/5
> [2] https://bugs.debian.org/943833
> --
>
> DAS-NETZWERKTEAM
> c\o Technik- und Ökologiezentrum Eckernförde
> Mike Gabriel, Marienthaler str. 17, 24340 Eckernförde
> mobile: +49 (1520) 1976 148
> landline: +49 (4351) 850 8940
>
> GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22  0782 9AF4 6B30 2577 1B31
> mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de
>
>

-- 
 --- Inguza Technology AB --- MSc in Information Technology ----
|  ola@inguza.com                    opal@debian.org            |
|  http://inguza.com/                Mobile: +46 (0)70-332 1551 |
 ---------------------------------------------------------------

[toc] | [prev] | [next] | [standalone]

#5701

FromMike Gabriel <mike.gabriel@das-netzwerkteam.de>
Date2019-10-31 09:00 +0100
Message-ID<yXdx8-Cp-3@gated-at.bofh.it>
In reply to#5700

[Multipart message — attachments visible in raw view] — view raw

Hi Ola,

On  Mi 30 Okt 2019 21:20:50 CET, Ola Lundqvist wrote:

> Hi
>
> I agree that the VNC situation in Debian is sub-optimal. Frankly speaking
> not just in Debian. This popular software has diverged quite a lot with lot
> of packages sharing similar code-base.
>
> I had a brief look at vnc4 as well. It does not seem to share the same code
> base as libvncserver so it should not be affected.
>
> Best regards
>
> // Ola

Ok. Thanks for that.

I claimed tightvnc in dla-needed.txt. As you are the maintainer, let  
me know if you want to pick that one up instead (I am happy to include  
it in my fix upload series, if not).

My plan is to go over VNC related packages over the next couple of  
days and also propose .debdiffs for stretch versions.

Thanks,
Mike
-- 

DAS-NETZWERKTEAM
c\o Technik- und Ökologiezentrum Eckernförde
Mike Gabriel, Marienthaler str. 17, 24340 Eckernförde
mobile: +49 (1520) 1976 148
landline: +49 (4351) 850 8940

GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22  0782 9AF4 6B30 2577 1B31
mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de

[toc] | [prev] | [next] | [standalone]

#5702

FromOla Lundqvist <ola@inguza.com>
Date2019-11-04 10:20 +0100
Message-ID<yYGGJ-79e-1@gated-at.bofh.it>
In reply to#5701

[Multipart message — attachments visible in raw view] — view raw

Hi Mike

Please go ahead. I will be off for some time due to a planned surgery so it
would be very good if you can fix this.

// Ola

On Thu, 31 Oct 2019 at 08:55, Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
wrote:

> Hi Ola,
>
> On  Mi 30 Okt 2019 21:20:50 CET, Ola Lundqvist wrote:
>
> > Hi
> >
> > I agree that the VNC situation in Debian is sub-optimal. Frankly speaking
> > not just in Debian. This popular software has diverged quite a lot with
> lot
> > of packages sharing similar code-base.
> >
> > I had a brief look at vnc4 as well. It does not seem to share the same
> code
> > base as libvncserver so it should not be affected.
> >
> > Best regards
> >
> > // Ola
>
> Ok. Thanks for that.
>
> I claimed tightvnc in dla-needed.txt. As you are the maintainer, let
> me know if you want to pick that one up instead (I am happy to include
> it in my fix upload series, if not).
>
> My plan is to go over VNC related packages over the next couple of
> days and also propose .debdiffs for stretch versions.
>
> Thanks,
> Mike
> --
>
> DAS-NETZWERKTEAM
> c\o Technik- und Ökologiezentrum Eckernförde
> Mike Gabriel, Marienthaler str. 17, 24340 Eckernförde
> mobile: +49 (1520) 1976 148
> landline: +49 (4351) 850 8940
>
> GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22  0782 9AF4 6B30 2577 1B31
> mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de
>
>

-- 
 --- Inguza Technology AB --- MSc in Information Technology ----
|  ola@inguza.com                    opal@debian.org            |
|  http://inguza.com/                Mobile: +46 (0)70-332 1551 |
 ---------------------------------------------------------------

[toc] | [prev] | [next] | [standalone]

#5703

FromMike Gabriel <mike.gabriel@das-netzwerkteam.de>
Date2019-11-04 10:30 +0100
Message-ID<yYGQp-7cq-1@gated-at.bofh.it>
In reply to#5702

[Multipart message — attachments visible in raw view] — view raw

Hi Ola,

On  Mo 04 Nov 2019 09:58:27 CET, Ola Lundqvist wrote:

> Hi Mike
>
> Please go ahead. I will be off for some time due to a planned surgery so it
> would be very good if you can fix this.
>
> // Ola

ACK. Good luck with the surgery.

Mike

-- 

DAS-NETZWERKTEAM
c\o Technik- und Ökologiezentrum Eckernförde
Mike Gabriel, Marienthaler str. 17, 24340 Eckernförde
mobile: +49 (1520) 1976 148
landline: +49 (4351) 850 8940

GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22  0782 9AF4 6B30 2577 1B31
mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.security

csiph-web