http://bugzilla.mindrot.org/show_bug.cgi?id=803
Summary: Security Bug: X11 Forwarding is more powerful than it
needs to be.
Product: Portable OpenSSH
Version: -current
Platform: All
OS/Version: All
Status: NEW
Severity: major
Priority: P2
Component: ssh
AssignedTo: openssh-bugs@mindrot.org
ReportedBy: holger@van-lengerich.de
Hi,
I just played a little bit with xauth and I thought I should drop a note in here:
Brief SSH X11 forwarding history:
1995 Tatu Ylönen releases ssh v1.0.0 including the X11 Forwarding feature
1996 Security extensions were defined for X11
http://www.xfree86.org/~herrb/security.pdf
1997 Ulrich Flegel determines that X11 forwarding
ftp://ftp.dfn-cert.de/pub/docs/crypt/ssh-x11.ps.gz
in response Alan Cox suggested that X11 Security Extensions may be used
to limit the access of remote applications to the local X11 server
2004 X11 Forwarding is as dangerous as it was 1995:
- keylogging (even though "secure keyboard" is used in
(xterm|ssh-agent|xscreensaver)
- I was able to attach a X0vncserver process on an forwarded X-display
and got complete remote control.
- screenshots of root window is possible through 'xwd' or ImageMagick's
'import'
Time for a change isn't it? :)
I am able to implement Alan Cox's suggestion with 3 lines in a shell:
--- 8< ---
# transfer 'trusted' cookie to new file:
xauth extract - $DISPLAY | xauth -f $HOME/.sshXauthority merge -
# replace 'trusted' cookie with 'untrusted' cookie
xauth -f .sshXauthority generate $DISPLAY . untrusted
# tell applications where to get the untrusted cookie
export XAUTHORITY=$HOME/.sshXauthority
--- >8 ---
An attacker on the remote host is no more able to
log keystrokes, taking screenshots or do remote control stuff.
So please consider:
- mentioning the possibility of crippling access rights to the Xserver with
xauth in the manpage of ssh / ssh_config
or better:
- modify SSH client to generate an untrusted cookie on its own and
using it for forwarded X11 requests. Of course there should be
possibility for choosing between 'trusted' or 'untrusted' X11 forwarding.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
Summary: Security Bug: X11 Forwarding is more powerful than it
needs to be.
Product: Portable OpenSSH
Version: -current
Platform: All
OS/Version: All
Status: NEW
Severity: major
Priority: P2
Component: ssh
AssignedTo: openssh-bugs@mindrot.org
ReportedBy: holger@van-lengerich.de
Hi,
I just played a little bit with xauth and I thought I should drop a note in here:
Brief SSH X11 forwarding history:
1995 Tatu Ylönen releases ssh v1.0.0 including the X11 Forwarding feature
1996 Security extensions were defined for X11
http://www.xfree86.org/~herrb/security.pdf
1997 Ulrich Flegel determines that X11 forwarding
ftp://ftp.dfn-cert.de/pub/docs/crypt/ssh-x11.ps.gz
in response Alan Cox suggested that X11 Security Extensions may be used
to limit the access of remote applications to the local X11 server
2004 X11 Forwarding is as dangerous as it was 1995:
- keylogging (even though "secure keyboard" is used in
(xterm|ssh-agent|xscreensaver)
- I was able to attach a X0vncserver process on an forwarded X-display
and got complete remote control.
- screenshots of root window is possible through 'xwd' or ImageMagick's
'import'
Time for a change isn't it? :)
I am able to implement Alan Cox's suggestion with 3 lines in a shell:
--- 8< ---
# transfer 'trusted' cookie to new file:
xauth extract - $DISPLAY | xauth -f $HOME/.sshXauthority merge -
# replace 'trusted' cookie with 'untrusted' cookie
xauth -f .sshXauthority generate $DISPLAY . untrusted
# tell applications where to get the untrusted cookie
export XAUTHORITY=$HOME/.sshXauthority
--- >8 ---
An attacker on the remote host is no more able to
log keystrokes, taking screenshots or do remote control stuff.
So please consider:
- mentioning the possibility of crippling access rights to the Xserver with
xauth in the manpage of ssh / ssh_config
or better:
- modify SSH client to generate an untrusted cookie on its own and
using it for forwarded X11 requests. Of course there should be
possibility for choosing between 'trusted' or 'untrusted' X11 forwarding.
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.