Re: [Xen-devel] [PATCH][Take 3] VNC authentification

[Anthony Liguori <aliguori@xxxxxxxxxx>]

Masami Watanabe wrote:
> +static int vnc_auth(VncState *vs)
> +{
> +    extern char vncpasswd[64];
> +    extern unsigned char challenge[AUTHCHALLENGESIZE];
> +
> +    if (*vncpasswd == '\0') {
> +       /* AuthType is None */
> +       vnc_write_u32(vs, 1);
> +       vnc_flush(vs);
> +       vnc_read_when(vs, protocol_client_init, 1);
> +    } else {
> +       /* AuthType is VncAuth */
> +       vnc_write_u32(vs, 2);
> +       vnc_flush(vs);
> +
> +       /* Read AuthType */
> +       vnc_read_when(vs, protocol_authtype, 1);
>   
As I mentioned before, you cannot have to vnc_read_when()'s execution 
path without returning the the mainloop.
protocol_authtype() cannot possibly be invoked.  If the code is working 
now, it's pure luck.
There was just a very high profile RealVNC vulnerability that was due to 
improper authtype handling.  It's very important we do this right so we 
don't duplicate this bug.
Regards,

Anthony Liguori

> +       /* Send Challenge */
> +       make_challenge(challenge, AUTHCHALLENGESIZE);
> +       vnc_write(vs, challenge, AUTHCHALLENGESIZE);
> +       vnc_flush(vs);
> +
> +       /* Read Responce */
> +       vnc_read_when(vs, protocol_response, AUTHCHALLENGESIZE);
> +    }
> +
> +    return 0;
> +}
>   
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@xxxxxxxxxxxxxxxxxxx
> http://lists.xensource.com/xen-devel
>
>   
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel