xen-devel
Re: [Xen-devel] [PATCH][Take 3] VNC authentification
Masami Watanabe wrote:
+static int vnc_auth(VncState *vs)
+{
+ extern char vncpasswd[64];
+ extern unsigned char challenge[AUTHCHALLENGESIZE];
+
+ if (*vncpasswd == '0円') {
+ /* AuthType is None */
+ vnc_write_u32(vs, 1);
+ vnc_flush(vs);
+ vnc_read_when(vs, protocol_client_init, 1);
+ } else {
+ /* AuthType is VncAuth */
+ vnc_write_u32(vs, 2);
+ vnc_flush(vs);
+
+ /* Read AuthType */
+ vnc_read_when(vs, protocol_authtype, 1);
As I mentioned before, you cannot have to vnc_read_when()'s execution
path without returning the the mainloop.
protocol_authtype() cannot possibly be invoked. If the code is working
now, it's pure luck.
There was just a very high profile RealVNC vulnerability that was due to
improper authtype handling. It's very important we do this right so we
don't duplicate this bug.
Regards,
Anthony Liguori
+ /* Send Challenge */
+ make_challenge(challenge, AUTHCHALLENGESIZE);
+ vnc_write(vs, challenge, AUTHCHALLENGESIZE);
+ vnc_flush(vs);
+
+ /* Read Responce */
+ vnc_read_when(vs, protocol_response, AUTHCHALLENGESIZE);
+ }
+
+ return 0;
+}
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel
|