On Wed, Aug 24, 2011 at 07:45:06AM -0500, Anthony Liguori wrote:
On 08/24/2011 06:01 AM, Daniel P. Berrange wrote:
From: "Daniel P. Berrange"<address@hidden>
In CVE-2011-0011 it was noted that setting an empty password
would disable all authentication for the VNC password. Commit
1cd20f8bf0ecb9d1d1bd5e2ffab3b88835380c9b attempted to fix this
but it just broke it in a different way, because now instead
of blindly disabling all authentication, it blindly resets all
authentication to 'VNC'.
But this is *not* a security problem. Login becomes disabled as expected.
It *is* a security problem, because if you do
change vnc password 123
change vnc password ""
change vnc password 456
you have lost the authentication settings you requested.
With this patch, changing the password to "" *still* disables
the login, without side effects on the auth scheme.
We should really not overload the semantics of the change command
like this and instead introduce a new QMP operation to disable
login.
This change I mention below is the one that overloaded the semantics
by making a password change, also change the auth scheme, breaking
the original behaviour. If we want apps to be able to change the
auth scheme that needs a separate monitor command.
The current behaviour is not usable and introduces a security problem
by changing auth scheme without being asked to.