Re: [Qemu-devel] [PATCH STABLE-0.14/0.15/master] CVE-2011-0011: fix VNC password change to not touch authentication settings

[Daniel P. Berrange]

On Wed, Aug 24, 2011 at 07:45:06AM -0500, Anthony Liguori wrote:
> On 08/24/2011 06:01 AM, Daniel P. Berrange wrote:
> >From: "Daniel P. Berrange"<address@hidden>
> >
> >In CVE-2011-0011 it was noted that setting an empty password
> >would disable all authentication for the VNC password. Commit
> >1cd20f8bf0ecb9d1d1bd5e2ffab3b88835380c9b attempted to fix this
> >but it just broke it in a different way, because now instead
> >of blindly disabling all authentication, it blindly resets all
> >authentication to 'VNC'.
> 
> But this is *not* a security problem.  Login becomes disabled as expected.

It *is* a security problem, because if you do

  change vnc password 123
  change vnc password ""
  change vnc password 456

you have lost the authentication settings you requested.

With this patch, changing the password to "" *still* disables
the login, without side effects on the auth scheme.

> We should really not overload the semantics of the change command
> like this and instead introduce a new QMP operation to disable
> login.

This change I mention below is the one that overloaded the semantics
by making a password change, also change the auth scheme, breaking
the original behaviour.  If we want apps to be able to change the
auth scheme that needs a separate monitor command.

The current behaviour is not usable and introduces a security problem
by changing auth scheme without being asked to.

Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vnc :|