X2Go Bug report logs - #335
Users can inject arbitrary data into Pyhoca-GUI via .bashrc

version graph

Package: python-x2go; Maintainer for python-x2go is X2Go Developers <x2go-dev@lists.x2go.org>; Source for python-x2go is src:python-x2go.

Reported by: "Dan Halbert" <halbert@halwitz.org>

Date: Mon, 21 Oct 2013 12:48:02 UTC

Severity: grave

Tags: confirmed, pending

Fixed in version 0.4.0.9

Done: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>

Bug is archived. No further changes may be made.

Full log

🔗 View this message in rfc822 format

X-Loop: owner@bugs.x2go.org
Subject: Bug#327: [X2Go-Dev] Bug#327: x2go client crashes if .bashrc prints anything
Reply-To: Dan Halbert <halbert@halwitz.org>, 327@bugs.x2go.org
Resent-From: Dan Halbert <halbert@halwitz.org>
Resent-To: x2go-dev@lists.berlios.de
Resent-CC: X2Go Developers <x2go-dev@lists.berlios.de>
X-Loop: owner@bugs.x2go.org
Resent-Date: Tue, 29 Oct 2013 12:03:01 +0000
Resent-Message-ID: <handler.327.B327.138304810723738@bugs.x2go.org>
Resent-Sender: owner@bugs.x2go.org
X-X2Go-PR-Message: followup 327
X-X2Go-PR-Package: x2goclient
X-X2Go-PR-Keywords: confirmed
Received: via spool by 327-submit@bugs.x2go.org id=B327.138304810723738
          (code B ref 327); Tue, 29 Oct 2013 12:03:01 +0000
Received: (at 327) by bugs.x2go.org; 29 Oct 2013 12:01:47 +0000
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on
	ymir.das-netzwerkteam.de
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00 autolearn=ham
	version=3.3.2
X-Greylist: delayed 370 seconds by postgrey-1.34 at ymir; Tue, 29 Oct 2013 13:01:46 CET
Received: from smtp159.ord.emailsrvr.com (smtp159.ord.emailsrvr.com [173.203.6.159])
	by ymir (Postfix) with ESMTPS id 6BF255DA6C
	for <327@bugs.x2go.org>; Tue, 29 Oct 2013 13:01:46 +0100 (CET)
Received: from localhost (localhost.localdomain [127.0.0.1])
	by smtp20.relay.ord1a.emailsrvr.com (SMTP Server) with ESMTP id 9B5E41C04CF;
	Tue, 29 Oct 2013 07:55:34 -0400 (EDT)
X-Virus-Scanned: OK
Received: by smtp20.relay.ord1a.emailsrvr.com (Authenticated sender: halbert-AT-halwitz.org) with ESMTPSA id 51F9F1C04FD;
	Tue, 29 Oct 2013 07:55:34 -0400 (EDT)
Message-ID: <526FA219.9030701@halwitz.org>
Date: Tue, 29 Oct 2013 07:55:05 -0400
From: Dan Halbert <halbert@halwitz.org>
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:24.0) Gecko/20100101 Thunderbird/24.0.1
MIME-Version: 1.0
To: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>, 327@bugs.x2go.org
CC: control@bugs.x2go.org
References: <1382199763.63727452@beta.apps.rackspace.com> <20131029083628.Horde.8Mmv6w__TzqxxZW5QIjqjw9@mail.das-netzwerkteam.de>
In-Reply-To: <20131029083628.Horde.8Mmv6w__TzqxxZW5QIjqjw9@mail.das-netzwerkteam.de>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

On 10/29/2013 4:36 AM, Mike Gabriel wrote:
> If I put an
>> echo "testing"   # exact text doesn't matter
>
> I presume, this on the server.
Right, this is on the server. With the Windows client there is no 
.bashrc anyway. I confirmed with my colleague that he saw this on both 
the Windows and Ubuntu Precise clients.

Which windowing system chosen on the server does not seem to matter 
either. I saw it with UNITY and with just "Terminal".

> I could confirm this issue on Debian wheezy or Ubuntu precise as X2Go 
> Server. On Ubuntu lucid, the problem does not occur.
That's interesting. The reason for putting in the echo's was to debug a 
completely unrelated problem about which shell init got run when we were 
running some batch jobs. I had instrumented the init files before 
without difficulty. Thanks for looking at this.

Send a report that this bug log contains spam.

X2Go Developers <owner@bugs.x2go.org>. Last modified: Thu Nov 21 20:28:49 2024; Machine Name: ymir.das-netzwerkteam.de

X2Go Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.