Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 579308 - x11-misc/x11vnc: option -localhost fails to restrict ipv6 access
Summary: x11-misc/x11vnc: option -localhost fails to restrict ipv6 access
Status: RESOLVED INVALID
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor
Assignee: Gentoo Security
URL:
Whiteboard: B3 [upstream]
Keywords:
: 603036 (view as bug list)
Depends on:
Blocks:
 
Reported: 2016-04-08 09:07 UTC by Agostino Sarubbo
Modified: 2016-12-19 03:32 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2016-04-08 09:07:24 UTC
From ${URL} :

When starting the x11vnc with -localhost specified, it fail to restrict IPv6 accessibility to 
localhost. This is in conflict with the manual, which states:

-localhost
[...]
IPv6: if IPv6 is supported, this option automatically implies the IPv6 loopback address '::1' as 
well.


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Ian Delaney (RETIRED) gentoo-dev 2016-04-16 10:42:25 UTC
Is this a standardised message input ?  Where does it say this requires a version bump ?
Comment 2 Alex Xu (Hello71) 2016-04-16 12:26:15 UTC
$ x11vnc -localhost &
< ... >
$ ss -plA inet sport = 5900
Netid  State      Recv-Q Send-Q Local Address:Port                 Peer Address:Port                
tcp    LISTEN     0      32     127.0.0.1:5900                  *:*                    
tcp    LISTEN     0      32     :::5900                 :::*                    
$ vncviewer '[2001:<snip>::1]'
TigerVNC Viewer 64-bit v1.6.0
Built on: 2016-04-16 08:08
Copyright (C) 1999-2015 TigerVNC Team and many others (see README.txt)
See http://www.tigervnc.org for information on TigerVNC.

Sat Apr 16 08:18:29 2016
 CConn:       connected to host 2001:<snip>::1 port 5900
16/04/2016 08:18:29 Got connection from client 2001:<snip>::1
16/04/2016 08:18:29   other clients:
16/04/2016 08:18:29 Normal socket connection
16/04/2016 08:18:29 denying client: 2001:<snip>::1 does not match 127.0.0.1
16/04/2016 08:18:29 Client 2001:<snip>::1 gone
16/04/2016 08:18:29 Statistics             events    Transmit/ RawEquiv ( saved)
16/04/2016 08:18:29  TOTALS              :      0 |         0/        0 (  0.0%)
16/04/2016 08:18:29 Statistics             events    Received/ RawEquiv ( saved)
16/04/2016 08:18:29  TOTALS              :      0 |         0/        0 (  0.0%)
 CConn:       End of stream
$ socat -d -d tcp-connect:'[2001:<snip>::1]':5900 -
2016/04/16 08:02:57 socat[1447] N opening connection to AF=10 [2001:<snip>:0001]:5900
2016/04/16 08:02:57 socat[1447] N successfully connected from local address AF=10 [2001:<snip>:0001]:49560
2016/04/16 08:02:57 socat[1447] N reading from and writing to stdio
2016/04/16 08:02:57 socat[1447] N starting data transfer loop with FDs [5,5] and [0,1]
16/04/2016 08:02:57 Got connection from client 2001:<snip>::1
16/04/2016 08:02:57   other clients:
16/04/2016 08:02:57 Normal socket connection
16/04/2016 08:02:57 denying client: 2001:<snip>::1 does not match 127.0.0.1
16/04/2016 08:02:57 Client 2001:<snip>::1 gone
16/04/2016 08:02:57 Statistics             events    Transmit/ RawEquiv ( saved)
16/04/2016 08:02:57  TOTALS              :      0 |         0/        0 (  0.0%)
16/04/2016 08:02:57 RFB 003.008
Statistics             events    Received/ RawEquiv ( saved)
16/04/2016 08:02:57  TOTALS              :      0 |         0/        0 (  0.0%)
2016/04/16 08:02:57 socat[1447] N socket 1 (fd 5) is at EOF
2016/04/16 08:02:58 socat[1447] N exiting with status 0
$ vncviewer '[::1]'
TigerVNC Viewer 64-bit v1.6.0
Built on: 2016-04-16 08:08
Copyright (C) 1999-2015 TigerVNC Team and many others (see README.txt)
See http://www.tigervnc.org for information on TigerVNC.

Sat Apr 16 08:25:31 2016
 CConn:       connected to host ::1 port 5900
16/04/2016 08:25:31 Got connection from client ::1
16/04/2016 08:25:31   other clients:
16/04/2016 08:25:31 Normal socket connection
16/04/2016 08:25:31 check_access: client addr ::1 is local.
< ... >
Comment 3 Alex Xu (Hello71) 2016-12-19 03:32:35 UTC
*** Bug 603036 has been marked as a duplicate of this bug. ***