X2Go Bug report logs - #335
Users can inject arbitrary data into Pyhoca-GUI via .bashrc

version graph

Package: python-x2go; Maintainer for python-x2go is X2Go Developers <x2go-dev@lists.x2go.org>; Source for python-x2go is src:python-x2go.

Reported by: "Dan Halbert" <halbert@halwitz.org>

Date: Mon, 21 Oct 2013 12:48:02 UTC

Severity: grave

Tags: confirmed, pending

Fixed in version 0.4.0.9

Done: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>

Bug is archived. No further changes may be made.

Full log


🔗 View this message in rfc822 format

X-Loop: owner@bugs.x2go.org
Subject: Bug#327: x2go client crashes if .bashrc prints anything
Reply-To: "Dan Halbert" <halbert@halwitz.org>, 327@bugs.x2go.org
Resent-From: "Dan Halbert" <halbert@halwitz.org>
Resent-To: x2go-dev@lists.berlios.de
Resent-CC: X2Go Developers <x2go-dev@lists.berlios.de>
X-Loop: owner@bugs.x2go.org
Resent-Date: Mon, 21 Oct 2013 12:48:02 +0000
Resent-Message-ID: <handler.327.B.138235930328998@bugs.x2go.org>
Resent-Sender: owner@bugs.x2go.org
X-X2Go-PR-Message: report 327
X-X2Go-PR-Package: x2goclient
X-X2Go-PR-Keywords: 
Received: via spool by submit@bugs.x2go.org id=B.138235930328998
          (code B); Mon, 21 Oct 2013 12:48:02 +0000
Received: (at submit) by bugs.x2go.org; 21 Oct 2013 12:41:43 +0000
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on
	ymir.das-netzwerkteam.de
X-Spam-Level: 
X-Spam-Status: No, score=-0.6 required=5.0 tests=BAYES_00,HTML_MESSAGE,
	RCVD_IN_BL_SPAMCOP_NET,RCVD_IN_DNSWL_BLOCKED autolearn=no version=3.3.2
X-Greylist: delayed 4199 seconds by postgrey-1.34 at ymir; Mon, 21 Oct 2013 14:41:42 CEST
Received: from smtp122.dfw.emailsrvr.com (smtp122.dfw.emailsrvr.com [67.192.241.122])
	by ymir (Postfix) with ESMTPS id DBE4A5DB16
	for <submit@bugs.x2go.org>; Mon, 21 Oct 2013 14:41:42 +0200 (CEST)
Received: from localhost (localhost.localdomain [127.0.0.1])
	by smtp12.relay.dfw1a.emailsrvr.com (SMTP Server) with ESMTP id 14F15300DC
	for <submit@bugs.x2go.org>; Sat, 19 Oct 2013 12:22:47 -0400 (EDT)
X-Virus-Scanned: OK
Received: from smtp66.iad3a.emailsrvr.com (smtp66.iad3a.emailsrvr.com [173.203.187.66])
	by smtp12.relay.dfw1a.emailsrvr.com (SMTP Server) with ESMTPS id E72D230335
	for <submit@bugs.x2go.org>; Sat, 19 Oct 2013 12:22:46 -0400 (EDT)
Received: from localhost (localhost.localdomain [127.0.0.1])
	by smtp1.relay.iad3a.emailsrvr.com (SMTP Server) with ESMTP id 07F02600BB;
	Sat, 19 Oct 2013 12:22:44 -0400 (EDT)
X-Virus-Scanned: OK
Received: from app40.wa-webapps.iad3a (relay.iad3a.rsapps.net [172.27.255.110])
	by smtp1.relay.iad3a.emailsrvr.com (SMTP Server) with ESMTP id DB48D600B8;
	Sat, 19 Oct 2013 12:22:43 -0400 (EDT)
Received: from halwitz.org (localhost.localdomain [127.0.0.1])
	by app40.wa-webapps.iad3a (Postfix) with ESMTP id 9C18F300044;
	Sat, 19 Oct 2013 12:22:43 -0400 (EDT)
Received: by beta.apps.rackspace.com
    (Authenticated sender: halbert@halwitz.org, from: halbert@halwitz.org) 
    with HTTP; Sat, 19 Oct 2013 12:22:43 -0400 (EDT)
Date: Sat, 19 Oct 2013 12:22:43 -0400 (EDT)
From: "Dan Halbert" <halbert@halwitz.org>
To: submit@bugs.x2go.org
MIME-Version: 1.0
Content-Type: multipart/alternative;boundary="----=_20131019122243000000_69938"
Importance: Normal
X-Priority: 3 (Normal)
X-Type: html
Message-ID: <1382199763.63727452@beta.apps.rackspace.com>
X-Mailer: webmail7.0
[Message part 1 (text/plain, inline)]
Package: x2goclient
Version: 4.0.0.3
 
If I put an
echo "testing"   # exact text doesn't matter
 
at the top of my .bashrc, then the x2goclient crashes immediately when trying to start a session.
 
(The crash does not occur if I put a similar statement in .bash_login.)
 
I have reproduced this on the Windows client; I believe a colleague saw it on both the Windows and Linux clients.
 
The x2go server being used is  4.0.1.6-0~712~precise1.

[Message part 2 (text/html, inline)]

Send a report that this bug log contains spam.


X2Go Developers <owner@bugs.x2go.org>. Last modified: Thu Nov 21 20:41:48 2024; Machine Name: ymir.das-netzwerkteam.de

X2Go Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.