Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-12-SP3:GA
libvirt.11411
bb848fee-CVE-2016-5008.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File bb848fee-CVE-2016-5008.patch of Package libvirt.11411
commit f39de9abfd4b8b19a012169355a0e73dae427bd0 Author: Jiri Denemark <jdenemar@redhat.com> Date: Tue Jun 28 14:39:58 2016 +0200 qemu: Let empty default VNC password work as documented CVE-2016-5008 Setting an empty graphics password is documented as a way to disable VNC/SPICE access, but QEMU does not always behaves like that. VNC would happily accept the empty password. Let's enforce the behavior by setting password expiration to "now". https://bugzilla.redhat.com/show_bug.cgi?id=1180092 Signed-off-by: Jiri Denemark <jdenemar@redhat.com> (cherry picked from commit bb848feec0f3f10e92dd8e5231ae7aa89b5598f3) (cherry picked from commit d933f68ee660566b52cd90330aee0d5f414636a4) Index: libvirt-1.2.5/src/qemu/qemu_hotplug.c =================================================================== --- libvirt-1.2.5.orig/src/qemu/qemu_hotplug.c +++ libvirt-1.2.5/src/qemu/qemu_hotplug.c @@ -3463,6 +3463,7 @@ qemuDomainChangeGraphicsPasswords(virQEM time_t now = time(NULL); char expire_time [64]; const char *connected = NULL; + const char *password; int ret = -1; virQEMUDriverConfigPtr cfg = virQEMUDriverGetConfig(driver); @@ -3470,15 +3471,13 @@ qemuDomainChangeGraphicsPasswords(virQEM ret = 0; goto cleanup; } + password = auth->passwd ? auth->passwd : defaultPasswd; if (auth->connected) connected = virDomainGraphicsAuthConnectedTypeToString(auth->connected); qemuDomainObjEnterMonitor(driver, vm); - ret = qemuMonitorSetPassword(priv->mon, - type, - auth->passwd ? auth->passwd : defaultPasswd, - connected); + ret = qemuMonitorSetPassword(priv->mon, type, password, connected); if (ret == -2) { if (type != VIR_DOMAIN_GRAPHICS_TYPE_VNC) { @@ -3486,14 +3485,15 @@ qemuDomainChangeGraphicsPasswords(virQEM _("Graphics password only supported for VNC")); ret = -1; } else { - ret = qemuMonitorSetVNCPassword(priv->mon, - auth->passwd ? auth->passwd : defaultPasswd); + ret = qemuMonitorSetVNCPassword(priv->mon, password); } } if (ret != 0) goto end_job; - if (auth->expires) { + if (password[0] == '\0') { + snprintf(expire_time, sizeof(expire_time), "now"); + } else if (auth->expires) { time_t lifetime = auth->validTo - now; if (lifetime <= 0) snprintf(expire_time, sizeof(expire_time), "now");
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor