X2Go Bug report logs - #258
SECURITY: x2goclient allows clipboard sniffing

version graph

Package: x2goclient; Maintainer for x2goclient is X2Go Developers <x2go-dev@lists.x2go.org>; Source for x2goclient is src:x2goclient.

Reported by: Christoph Anton Mitterer <calestyo@scientia.net>

Date: Mon, 1 Jul 2013 02:48:02 UTC

Severity: grave

Tags: pending, security

Fixed in version 4.0.2.1

Done: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>

Bug is archived. No further changes may be made.

Full log


Message #86 received at 258@bugs.x2go.org (full text, mbox, reply):

Received: (at 258) by bugs.x2go.org; 29 Jun 2014 15:01:21 +0000
From mike.gabriel@das-netzwerkteam.de  Sun Jun 29 17:01:20 2014
X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on
	ymir.das-netzwerkteam.de
X-Spam-Level: 
X-Spam-Status: No, score=-1.9 required=5.0 tests=BAYES_00 autolearn=ham
	version=3.3.2
Received: from freya.das-netzwerkteam.de (freya.das-netzwerkteam.de [88.198.48.199])
	by ymir.das-netzwerkteam.de (Postfix) with ESMTPS id BE13D5DB53
	for <258@bugs.x2go.org>; Sun, 29 Jun 2014 17:01:20 +0200 (CEST)
Received: from grimnir.das-netzwerkteam.de (grimnir.das-netzwerkteam.de [78.46.204.98])
	by freya.das-netzwerkteam.de (Postfix) with ESMTPS id 5454F3A53;
	Sun, 29 Jun 2014 17:01:20 +0200 (CEST)
Received: from localhost (localhost [127.0.0.1])
	by grimnir.das-netzwerkteam.de (Postfix) with ESMTP id 2E95F3C703;
	Sun, 29 Jun 2014 17:01:20 +0200 (CEST)
X-Virus-Scanned: Debian amavisd-new at grimnir.das-netzwerkteam.de
Received: from grimnir.das-netzwerkteam.de ([127.0.0.1])
	by localhost (grimnir.das-netzwerkteam.de [127.0.0.1]) (amavisd-new, port 10024)
	with ESMTP id jbsfXEjr1y1J; Sun, 29 Jun 2014 17:01:20 +0200 (CEST)
Received: from grimnir.das-netzwerkteam.de (localhost [127.0.0.1])
	by grimnir.das-netzwerkteam.de (Postfix) with ESMTPS id EC48E3BA23;
	Sun, 29 Jun 2014 17:01:19 +0200 (CEST)
Received: from p4FCFCF33.dip0.t-ipconnect.de (p4FCFCF33.dip0.t-ipconnect.de
 [79.207.207.51]) by mail.das-netzwerkteam.de (Horde Framework) with HTTP;
 Sun, 29 Jun 2014 15:01:19 +0000
Date: Sun, 29 Jun 2014 15:01:19 +0000
Message-ID: <20140629150119.Horde.MLdrTEOqKCSTi_kUqzY0cA2@mail.das-netzwerkteam.de>
From: Mike Gabriel <mike.gabriel@das-netzwerkteam.de>
To: o.schneyder@phoca-gmbh.de
Cc: 258@bugs.x2go.org
Subject: Clipboard mode configuration via X2Go Client session profiles
User-Agent: Internet Messaging Program (IMP) H5 (6.1.7)
Accept-Language: en,de
Organization: DAS-NETZWERKTEAM
X-Originating-IP: 79.207.207.51
X-Remote-Browser: Mozilla/5.0 (X11; Linux x86_64; rv:30.0) Gecko/20100101
 Firefox/30.0 Iceweasel/30.0
Content-Type: multipart/signed; boundary="=_8G8WNFFfC1mLt_HxrNZj9Q3";
 protocol="application/pgp-signature"; micalg=pgp-sha1
MIME-Version: 1.0
[Message part 1 (text/plain, inline)]
Hi Alex,

I have recently added means to set the clipboard (security) mode in  
X2Go sessions. That there is no way of restricting clipboard  
functionality in X2Go sessions has been quite an issue a while back on  
our mailing list and on the Debian bug tracker.

So, what I have done...


NX:

First, a patch for NX was necessary [1]. This patch adds the clipboard  
NX option to nxagent/x2goagent. There was some code for that already  
present in NX, but it looked like the feature never got finished (or  
other).


X2Go Server:

Second, I added a new cmdline arg to x2gostartagent and  
x2goresume-session [2]. Clients, that want to set the clipboard mode,  
have to send "both", "server", "client", or "none" as 10th cmdline  
parameter to x2gostartagent and as 8th cmdline parameter to  
x2goresume-session. If the client does not send that field, X2Go  
Server uses the default mode ("both").

If you want to test if an X2Go Server supports the clipboard mode  
feature, you can query

  $ x2gofeature X2GO_CLIPBOARD_MODES
  ok


Client-side:

Third, and this is what this mail is about, X2Go Client needs to send  
the clipboard mode to the server (x2gostartagent, x2goresume-session).  
In Python X2Go / PyHoca-GUI, I have already implemented this.

Python X2Go stores the clipboard information in ~/.x2goclient/sessions  
under the option name "clipboard=<str>" where its values can be  
"both", "server", "client", "none".

Relevant commits are: [3], [4], [5].

In X2Go Client's session profile window, the clipboard mode has to be  
made configurable.

Whenever you have time, can you take a look at that? Thanks.

light+love,
Mike



NX:

[1]  
http://code.x2go.org/gitweb?p=nx-libs.git;a=commitdiff;h=0cf283dca109ff29e18cd36fdbd2e51dadd52772;hp=c62b81304ca9906fe608f7387025162107d8d8ab

X2Go Server:

[2]  
http://code.x2go.org/gitweb?p=x2goserver.git;a=commitdiff;h=669b3aabb8f574a2bb30d415fb38b1ccf6837f0d

Python X2Go (combine the two commits to make sense):

[3]  
http://code.x2go.org/gitweb?p=python-x2go.git;a=commitdiff;h=08ff742334427cbe52ee02c354b9d73c53459f2e
[4]  
http://code.x2go.org/gitweb?p=python-x2go.git;a=commitdiff;h=2aa779efe39a045e6492ff891e5c5ce34393d6fc

PyHoca-GUI (session profile manager):

[5]  
http://code.x2go.org/gitweb?p=pyhoca-gui.git;a=commitdiff;h=d9d413b00fc92e35e4c9f752c853ba72c1399384
-- 

DAS-NETZWERKTEAM
mike gabriel, herweg 7, 24357 fleckeby
fon: +49 (1520) 1976 148

GnuPG Key ID 0x25771B31
mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de

freeBusy:
https://mail.das-netzwerkteam.de/freebusy/m.gabriel%40das-netzwerkteam.de.xfb
[Message part 2 (application/pgp-signature, inline)]

Send a report that this bug log contains spam.


X2Go Developers <owner@bugs.x2go.org>. Last modified: Thu Mar 28 21:15:10 2024; Machine Name: ymir.das-netzwerkteam.de

X2Go Bug tracking system

Debbugs is free software and licensed under the terms of the GNU Public License version 2. The current version can be obtained from https://bugs.debian.org/debbugs-source/.

Copyright © 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson, 2005-2017 Don Armstrong, and many other contributors.