#258 - SECURITY: x2goclient allows clipboard sniffing

X2Go Bug report logs - #258
SECURITY: x2goclient allows clipboard sniffing

Reported by: Christoph Anton Mitterer <calestyo@scientia.net>

Date: Mon, 1 Jul 2013 02:48:02 UTC

Severity: grave

Tags: pending, security

Fixed in version 4.0.2.1

Done: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>

Bug is archived. No further changes may be made.

Received: (at 258) by bugs.x2go.org; 29 Jun 2014 15:01:21 +0000
From mike.gabriel@das-netzwerkteam.de  Sun Jun 29 17:01:20 2014
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on
	ymir.das-netzwerkteam.de
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00 autolearn=ham
	version=3.3.2
Received: from freya.das-netzwerkteam.de (freya.das-netzwerkteam.de [88.198.48.199])
	by ymir.das-netzwerkteam.de (Postfix) with ESMTPS id BE13D5DB53
	for <258@bugs.x2go.org>; Sun, 29 Jun 2014 17:01:20 +0200 (CEST)
Received: from grimnir.das-netzwerkteam.de (grimnir.das-netzwerkteam.de [78.46.204.98])
	by freya.das-netzwerkteam.de (Postfix) with ESMTPS id 5454F3A53;
	Sun, 29 Jun 2014 17:01:20 +0200 (CEST)
Received: from localhost (localhost [127.0.0.1])
	by grimnir.das-netzwerkteam.de (Postfix) with ESMTP id 2E95F3C703;
	Sun, 29 Jun 2014 17:01:20 +0200 (CEST)
X-Virus-Scanned: Debian amavisd-new at grimnir.das-netzwerkteam.de
Received: from grimnir.das-netzwerkteam.de ([127.0.0.1])
	by localhost (grimnir.das-netzwerkteam.de [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id jbsfXEjr1y1J; Sun, 29 Jun 2014 17:01:20 +0200 (CEST)
Received: from grimnir.das-netzwerkteam.de (localhost [127.0.0.1])
	by grimnir.das-netzwerkteam.de (Postfix) with ESMTPS id EC48E3BA23;
	Sun, 29 Jun 2014 17:01:19 +0200 (CEST)
Received: from p4FCFCF33.dip0.t-ipconnect.de (p4FCFCF33.dip0.t-ipconnect.de
 [79.207.207.51]) by mail.das-netzwerkteam.de (Horde Framework) with HTTP;
 Sun, 29 Jun 2014 15:01:19 +0000
Date: Sun, 29 Jun 2014 15:01:19 +0000
Message-ID: <20140629150119.Horde.MLdrTEOqKCSTi_kUqzY0cA2@mail.das-netzwerkteam.de>
From: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
To: o.schneyder@phoca-gmbh.de
Cc: 258@bugs.x2go.org
Subject: Clipboard mode configuration via X2Go Client session profiles
User-Agent: Internet Messaging Program (IMP) H5 (6.1.7)
Accept-Language: en,de
Organization: DAS-NETZWERKTEAM
X-Originating-IP: 79.207.207.51
X-Remote-Browser: Mozilla/5.0 (X11; Linux x86_64; rv:30.0) Gecko/20100101
 Firefox/30.0 Iceweasel/30.0
Content-Type: multipart/signed; boundary="=_8G8WNFFfC1mLt_HxrNZj9Q3";
 protocol="application/pgp-signature"; micalg=pgp-sha1
MIME-Version: 1.0

[Message part 1 (text/plain, inline)]

Hi Alex, I have recently added means to set the clipboard (security) mode in X2Go sessions. That there is no way of restricting clipboard functionality in X2Go sessions has been quite an issue a while back on our mailing list and on the Debian bug tracker. So, what I have done... NX: First, a patch for NX was necessary [1]. This patch adds the clipboard NX option to nxagent/x2goagent. There was some code for that already present in NX, but it looked like the feature never got finished (or other). X2Go Server: Second, I added a new cmdline arg to x2gostartagent and x2goresume-session [2]. Clients, that want to set the clipboard mode, have to send "both", "server", "client", or "none" as 10th cmdline parameter to x2gostartagent and as 8th cmdline parameter to x2goresume-session. If the client does not send that field, X2Go Server uses the default mode ("both"). If you want to test if an X2Go Server supports the clipboard mode feature, you can query $ x2gofeature X2GO_CLIPBOARD_MODES ok Client-side: Third, and this is what this mail is about, X2Go Client needs to send the clipboard mode to the server (x2gostartagent, x2goresume-session). In Python X2Go / PyHoca-GUI, I have already implemented this. Python X2Go stores the clipboard information in ~/.x2goclient/sessions under the option name "clipboard=<str>" where its values can be "both", "server", "client", "none". Relevant commits are: [3], [4], [5]. In X2Go Client's session profile window, the clipboard mode has to be made configurable. Whenever you have time, can you take a look at that? Thanks. light+love, Mike NX: [1] http://code.x2go.org/gitweb?p=nx-libs.git;a=commitdiff;h=0cf283dca109ff29e18cd36fdbd2e51dadd52772;hp=c62b81304ca9906fe608f7387025162107d8d8ab X2Go Server: [2] http://code.x2go.org/gitweb?p=x2goserver.git;a=commitdiff;h=669b3aabb8f574a2bb30d415fb38b1ccf6837f0d Python X2Go (combine the two commits to make sense): [3] http://code.x2go.org/gitweb?p=python-x2go.git;a=commitdiff;h=08ff742334427cbe52ee02c354b9d73c53459f2e [4] http://code.x2go.org/gitweb?p=python-x2go.git;a=commitdiff;h=2aa779efe39a045e6492ff891e5c5ce34393d6fc PyHoca-GUI (session profile manager): [5] http://code.x2go.org/gitweb?p=pyhoca-gui.git;a=commitdiff;h=d9d413b00fc92e35e4c9f752c853ba72c1399384 -- DAS-NETZWERKTEAM mike gabriel, herweg 7, 24357 fleckeby fon: +49 (1520) 1976 148 GnuPG Key ID 0x25771B31 mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de freeBusy: https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xfb

[Message part 2 (application/pgp-signature, inline)]

X2Go Developers <owner@bugs.x2go.org>. Last modified: Sat Nov 23 12:38:36 2024; Machine Name: ymir.das-netzwerkteam.de

X2Go Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

X2Go Bug report logs - #258 SECURITY: x2goclient allows clipboard sniffing

X2Go Bug report logs - #258
SECURITY: x2goclient allows clipboard sniffing