Bug 20244 - gtk-vnc new security issues CVE-2017-5884 and CVE-2017-5885
Summary: gtk-vnc new security issues CVE-2017-5884 and CVE-2017-5885
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 5
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL: https://lwn.net/Vulnerabilities/714260/
Whiteboard: advisory MGA5-32-OK MGA5-64-OK
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2017-02-05 15:39 CET by David Walser
Modified: 2017-02-20 14:01 CET (History)
5 users (show)

See Also:
Source RPM: gtk-vnc-0.6.0-2.mga6.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2017-02-05 15:39:53 CET
CVEs have been assigned for two security issues in gtk-vnc:
http://openwall.com/lists/oss-security/2017/02/05/5

Fixes appear to be in progress.

Mageia 5 may also be affected.
David Walser 2017-02-05 15:40:03 CET

Whiteboard: (none) => MGA5TOO

Comment 1 Marja Van Waes 2017-02-06 11:33:55 CET
Assigning to all packagers collectively, since there is no registered maintainer for this package.

CC: (none) => marja11
Assignee: bugsquad => pkg-bugs

Comment 2 Mike Rambo 2017-02-10 21:32:23 CET
Updated package uploaded and built for cauldron.


I could not find any previous test procedures for this package but did find that the vinagre VNC client uses some of these packages. That would probably be a good place to start testing if you have (or can set up) a VNC server you can connect to.


Updated package uploaded for Mageia 5.

Advisory:
========================

Updated gtk-vnc package fixes security vulnerabilities:

It was found that gtk-vnc code does not properly check boundaries of subrectangle-containing tiles. A malicious server can use this to overwrite parts of the client memory (CVE-2017-5884).

In addition, the vnc_connection_server_message() and vnc_color_map_set() functions do not check for integer overflow properly, leading to a malicious server being able to overwrite parts of the client memory (CVE-2017-5885).


References:
http://openwall.com/lists/oss-security/2017/02/05/5
https://bugzilla.gnome.org/show_bug.cgi?id=778048
https://bugzilla.gnome.org/show_bug.cgi?id=778050
========================

Updated packages in core/updates_testing:
========================
gtk-vnc-0.5.3-6.1.mga5.x86_64.rpm
gtk-vnc-debuginfo-0.5.3-6.1.mga5.x86_64.rpm
lib64gtk-vnc1.0_0-0.5.3-6.1.mga5.x86_64.rpm
lib64gtk-vnc1.0-devel-0.5.3-6.1.mga5.x86_64.rpm
lib64gtk-vnc2.0_0-0.5.3-6.1.mga5.x86_64.rpm
lib64gtk-vnc2.0-devel-0.5.3-6.1.mga5.x86_64.rpm
lib64gtkvnc-gir1.0-0.5.3-6.1.mga5.x86_64.rpm
lib64gtkvnc-gir2.0-0.5.3-6.1.mga5.x86_64.rpm
lib64gvnc1.0_0-0.5.3-6.1.mga5.x86_64.rpm
lib64gvnc1.0-devel-0.5.3-6.1.mga5.x86_64.rpm
lib64gvnc-gir1.0-0.5.3-6.1.mga5.x86_64.rpm
python-gtk-vnc-0.5.3-6.1.mga5.x86_64.rpm
gtk-vnc-i18n-0.5.3-6.1.mga5.noarch.rpm

from gtk-vnc-0.5.3-6.1.mga5.src.rpm

CC: (none) => mrambo
Version: Cauldron => 5
Assignee: pkg-bugs => qa-bugs
Whiteboard: MGA5TOO => (none)

Dave Hodgins 2017-02-11 22:53:11 CET

CC: (none) => davidwhodgins
Whiteboard: (none) => advisory

Comment 3 David Walser 2017-02-12 16:08:48 CET
Fedora has issued an advisory for this on February 10:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/LGPQ5MQR6SN4DYTEFACHP2PP5RR26KYK/

URL: (none) => https://lwn.net/Vulnerabilities/714260/

Comment 4 Herman Viaene 2017-02-15 17:48:10 CET
MGA5-32 on Asus A6000VM Xfce
No installation issues
Installed vinagre to test at CLI
$ strace -o vnc.txt vinagre
and found: open("/lib/libgtk-vnc-2.0.so.0", O_RDONLY|O_CLOEXEC) = 3

CC: (none) => herman.viaene
Whiteboard: advisory => advisory MGA5-32-OK

Comment 5 Dave Hodgins 2017-02-20 07:35:09 CET
Started vncserver on one system, setting a password.

Used gvncviewer to connect to that system ok from the system testing the update.

Validating the update

Keywords: (none) => validated_update
Whiteboard: advisory MGA5-32-OK => advisory MGA5-32-OK MGA5-64-OK
CC: (none) => sysadmin-bugs

Comment 6 Mageia Robot 2017-02-20 14:01:11 CET
An update for this issue has been pushed to the Mageia Updates repository.

http://advisories.mageia.org/MGASA-2017-0057.html

Status: NEW => RESOLVED
Resolution: (none) => FIXED


Note You need to log in before you can comment on or make changes to this bug.