LinuxQuestions.org
Did you know LQ has a Linux Hardware Compatibility List?
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices

Reply
 
Search this Thread
Old 06-19-2006, 04:55 PM   #1
nakko
Member
 
Registered: Oct 2004
Location: Austin, TX
Distribution: Ubuntu Dapper Drake
Posts: 39

Rep: Reputation: 15
x11vnc security hole to X?


Woops!
I just installed x11vnc and tightvnc-java. I set up a cool .x11vncrc in my home directory to keep the vnc session open, to look for a password I had generated with x11vnc -storepasswd, and so on. Pretty darn useful to connect to an already extant X desktop (like winders VNC) rather than creating some new one from scratch. I typed `x11vnc` and it started up according to my .x11vncrc configuration, then I connect to my computer from work --

I then realized that the X desktop it hooked me up to was not my own. It was another user I had created and left logged in to X. I never had to enter that user's password; it only checked the password in the password file I told it to generate in one of my directories. So, on a system where x11vnc is installed, could you not gain access to any other user's running X desktop? How could I make this more secure?
 
Old 06-19-2006, 05:04 PM   #2
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,398

Rep: Reputation: 1964Reputation: 1964Reputation: 1964Reputation: 1964Reputation: 1964Reputation: 1964Reputation: 1964Reputation: 1964Reputation: 1964Reputation: 1964Reputation: 1964
in order for the users desktop to be made accessible without using a password then they will have needed to run x11vnc with options to not require one. i don't see a security hole other than stupid users.
 
Old 06-19-2006, 05:09 PM   #3
nakko
Member
 
Registered: Oct 2004
Location: Austin, TX
Distribution: Ubuntu Dapper Drake
Posts: 39

Original Poster
Rep: Reputation: 15
But that other user did not run x11vnc, I did. In other words, x11vnc just hooked onto display :0, regardless that it was not my X desktop! That user whose X desktop I can have access to may be stupid, they may be smart, who can say? There was nothing that other user did to configure anything one way or another, all defaults so far as I know. Should some user, me, be able to access their desktop via x11vnc? Whether or not I "stupidly" ran x11vnc isn't going to make the other user feel better when I steal all their embarassing holiday photos or send incriminating emails, etc etc etc.
 
Old 06-19-2006, 05:16 PM   #4
acid_kewpie
Moderator
 
Registered: Jun 2001
Location: UK
Distribution: Gentoo, RHEL, Fedora, Centos
Posts: 43,398

Rep: Reputation: 1964Reputation: 1964Reputation: 1964Reputation: 1964Reputation: 1964Reputation: 1964Reputation: 1964Reputation: 1964Reputation: 1964Reputation: 1964Reputation: 1964
i'm not a position to test this but I would assume that your default xhosts configuration is less than ideal. by deafult only the server owner on local host should be able to connect to the server instance. if you run "xhost +localhost" then that would explicitly allow any local user to connec to the server, and allow things like x11vnc to be run. what is configured for that user if you run "xhost"?
 
Old 06-19-2006, 06:26 PM   #5
nakko
Member
 
Registered: Oct 2004
Location: Austin, TX
Distribution: Ubuntu Dapper Drake
Posts: 39

Original Poster
Rep: Reputation: 15
If this is the default behavior, isn't that pretty unsafe? I wouldn't know to change anything to keep someone gaining access to my desktop through VNC. I only noticed this by accident...
If I run `xhost` I get:
Code:
xhost:  unable to open display ""
 
  


Reply

Tags
security, vnc, x11, x11vnc


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
find security hole... os2 Linux - Security 5 10-13-2005 11:16 PM
check the security hole ust Linux - Security 6 09-10-2004 05:42 PM
panther security hole??? feetyouwell General 5 04-19-2004 10:03 AM
security hole or convenience? carboncopy Slackware 3 08-13-2003 03:07 AM
Security Hole in PHP 4.3.0 Crashed_Again Linux - Security 1 03-01-2003 03:29 PM


All times are GMT -5. The time now is 05:09 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration