[Security] vncviewer can send password without proper validation of X.509 certs

(CVE-2011-1775).

Reference: http://www.mail-archive.com/tigervnc-devel@lists.sourceforge.net/msg01342.html

git-svn-id: svn://svn.code.sf.net/p/tigervnc/code/branches/1_1@4400 3789f03b-4d11-0410-bbf8-ca57d06f2519

diff --git a/common/rfb/CSecurityTLS.cxx b/common/rfb/CSecurityTLS.cxx
index 6028792b8ab1515177c81d14118113f1df9c72f2..3421de5e5e9ead5cf9f2093589c06bc8239d301f 100644 (file)
--- a/common/rfb/CSecurityTLS.cxx
+++ b/common/rfb/CSecurityTLS.cxx
@@ -171,8 +171,15 @@ bool CSecurityTLS::processMsg(CConnection* cc)
     if (!is->checkNoWait(1))
       return false;
 
-    if (is->readU8() == 0)
-      return true;
+    if (is->readU8() == 0) {
+      rdr::U32 result = is->readU32();
+      CharArray reason;
+      if (result == secResultFailed || result == secResultTooMany)
+        reason.buf = is->readString();
+      else
+        reason.buf = strDup("Authentication failure (protocol error)");
+      throw AuthFailureException(reason.buf);
+    }
 
     if (gnutls_init(&session, GNUTLS_CLIENT) != GNUTLS_E_SUCCESS)
       throw AuthFailureException("gnutls_init failed");