Fix denial of service (CVE-2013-5745)

0001-Reject-new-clients-if-in-the-deferred-state.patch

@@ -0,0 +1,32 @@
+From 51435d3f946d6d2b99b876b7919b9d41022fc408 Mon Sep 17 00:00:00 2001
+From: David King <dking@redhat.com>
+Date: Wed, 11 Sep 2013 16:08:47 +0100
+Subject: [PATCH] Reject new clients if in the deferred state
+
+As mentioned in bug 641811, Vino can get stuck trying to process the
+same data in an infinite loop if an authentication request is received
+from a client while that client is in the deferred state.
+
+Avoid this situation by closing new connections from the same client
+when it is in the deferred state.
+---
+ server/libvncserver/rfbserver.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/server/libvncserver/rfbserver.c b/server/libvncserver/rfbserver.c
+index 7dfbff9..1295219 100644
+--- a/server/libvncserver/rfbserver.c
++++ b/server/libvncserver/rfbserver.c
+@@ -387,7 +387,8 @@ rfbProcessClientMessage(rfbClientPtr cl)
+         rfbAuthProcessClientMessage(cl);
+         return;
+     case RFB_AUTH_DEFERRED:
+-	rfbLog("Authentication deferred - ignoring client message\n");
++	rfbLog("Authentication deferred for this client - closing connection\n");
++	rfbCloseClient(cl);
+ 	return;
+     case RFB_INITIALISATION:
+         rfbProcessClientInitMessage(cl);
+-- 
+1.8.3.1
+

vino-allocation.patch

@@ -0,0 +1,32 @@
+From 81b5e3780f69e7a3c465afbe6cae9712d47c7deb Mon Sep 17 00:00:00 2001
+From: Matthias Clasen <mclasen@redhat.com>
+Date: Sat, 25 May 2013 00:52:07 -0400
+Subject: [PATCH] Be more careful with memory allocation
+
+Better to 0-initialize these structs, since GetValidIGD may
+not end up filling them.
+See https://bugzilla.redhat.com/attachment.cgi?id=707491
+for a related stacktrace.
+
+https://bugzilla.gnome.org/show_bug.cgi?id=700987
+---
+ server/vino-upnp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/server/vino-upnp.c b/server/vino-upnp.c
+index fcccfc7..99d7a71 100644
+--- a/server/vino-upnp.c
++++ b/server/vino-upnp.c
+@@ -91,8 +91,8 @@ update_upnp_status (VinoUpnp *upnp)
+   dprintf (UPNP, "found.\n");
+   dprintf (UPNP, "UPnP: Looking for a valid IGD... ");
+ 
+-  upnp->priv->urls = g_new (struct UPNPUrls, 1);
+-  upnp->priv->data = g_new (struct IGDdatas, 1);
++  upnp->priv->urls = g_new0 (struct UPNPUrls, 1);
++  upnp->priv->data = g_new0 (struct IGDdatas, 1);
+ 
+   res = UPNP_GetValidIGD (devlist,
+ 			  upnp->priv->urls,
+-- 
+1.8.2.1

vino.spec

@@ -5,10 +5,16 @@
 Summary: A remote desktop system for GNOME
 Name: vino
 Version: 3.8.1
-Release: 1%{?dist}
+Release: 3%{?dist}
 URL: http://www.gnome.org
 #VCS: git:git://git.gnome.org/vino
-Source0: http://download.gnome.org/sources/vino/3.6/%{name}-%{version}.tar.xz
+Source0: http://download.gnome.org/sources/vino/3.8/%{name}-%{version}.tar.xz
+
+# https://bugzilla.gnome.org/show_bug.cgi?id=700987
+Patch0: vino-allocation.patch
+
+# https://bugzilla.gnome.org/show_bug.cgi?id=641811
+Patch1: 0001-Reject-new-clients-if-in-the-deferred-state.patch
 
 License: GPLv2+
 Group: User Interface/Desktops
@@ -34,6 +40,8 @@ connect to a running GNOME session using VNC.
 
 %prep
 %setup -q
+%patch0 -p1
+%patch1 -p1
 
 # autoreconf -i -f
 # intltoolize --force
@@ -96,6 +104,12 @@ glib-compile-schemas %{_datadir}/glib-2.0/schemas &>/dev/null || :
 %{_datadir}/GConf/gsettings/org.gnome.Vino.convert
 
 %changelog
+* Wed Sep 18 2013 Debarshi Ray <rishi@fedorapeople.org> - 3.8.1-3
+- Fix denial of service (CVE-2013-5745)
+
+* Mon Jun 10 2013 Matthias Clasen <mclasen@redhat.com> - 3.8.1-2
+- Be more careful with memory allocation
+
 * Mon Apr 15 2013 Kalev Lember <kalevlember@gmail.com> - 3.8.1-1
 - Update to 3.8.1