Re: VNC viewers: Clipboard of host automatically sent to remote machine

[Giles Coochey <giles () coochey net>]

On 24/01/2012 16:06, Ben Bucksch wrote:
> On 24.01.2012 16:32, Giles Coochey wrote:
> > Many viewers, including RealVNC have the option to disable the shared
> > clipboard. Check your preferences.
> Indeed. But Vinagre doesn't.
>
> Even then, that is not sufficient, as explained in length.
I'm afraid as others have pointed out that by putting something in the 
Clipboard any local application can access that data, that's the point 
of the clipboard, to transfer the data between applications.

Now your argument is that you use an application that passes that 
clipboard to a remote server. From the forum posts I have seen this is 
an often requested feature and not usually considered a bug. The bug is 
what you're using the clipboard for, as you could have phrased your post 
that the problem is that the clipboard uses a plain text storage 
mechanism which makes the clipboard unsuitable for secure storage.

In any case, while not an option, there is a trivial patch to disable 
clipboard sharing in Vinagre:

--- a/src/vncconnection.c
+++ b/src/vncconnection.c
@@ -1579,14 +1579,7 @@
 gboolean vnc_connection_client_cut_text(VncConnection *conn,
                                        const void *data, size_t length)
 {
-       guint8 pad[3] = {0};
-
-       vnc_connection_buffered_write_u8(conn, 6);
-       vnc_connection_buffered_write(conn, pad, 3);
-       vnc_connection_buffered_write_u32(conn, length);
-       vnc_connection_buffered_write(conn, data, length);
-       vnc_connection_buffered_flush(conn);
-       return !vnc_connection_has_error(conn);
+       return TRUE;
 }

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/