Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: VNC viewers: Clipboard of host automatically sent to remote machine
From: Giles Coochey <giles () coochey net>
Date: Tue, 24 Jan 2012 19:08:54 +0000

On 24/01/2012 16:06, Ben Bucksch wrote:
On 24.01.2012 16:32, Giles Coochey wrote:
Many viewers, including RealVNC have the option to disable the shared
clipboard. Check your preferences.
Indeed. But Vinagre doesn't.

Even then, that is not sufficient, as explained in length.

I'm afraid as others have pointed out that by putting something in the Clipboard any local application can access that data, that's the point of the clipboard, to transfer the data between applications.

Now your argument is that you use an application that passes that clipboard to a remote server. From the forum posts I have seen this is an often requested feature and not usually considered a bug. The bug is what you're using the clipboard for, as you could have phrased your post that the problem is that the clipboard uses a plain text storage mechanism which makes the clipboard unsuitable for secure storage.

In any case, while not an option, there is a trivial patch to disable clipboard sharing in Vinagre:

--- a/src/vncconnection.c
+++ b/src/vncconnection.c
@@ -1579,14 +1579,7 @@
 gboolean vnc_connection_client_cut_text(VncConnection *conn,
                                        const void *data, size_t length)
-       guint8 pad[3] = {0};
-       vnc_connection_buffered_write_u8(conn, 6);
-       vnc_connection_buffered_write(conn, pad, 3);
-       vnc_connection_buffered_write_u32(conn, length);
-       vnc_connection_buffered_write(conn, data, length);
-       vnc_connection_buffered_flush(conn);
-       return !vnc_connection_has_error(conn);
+       return TRUE;

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature

Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]