CVE-2023-1393 and TigerVNC

[Andrew Aitchison]

[ Impact ]

In the TigerVNC package published for Mantic and earlier releases, it is possible for TigerVNC to be built against a version of xorg-server-source containing a known security vulnerability (CVE-2023-1393). This leaves TigerVNC open to potential attacks as a result.

This SRU is essentially a no-change rebuild so that the latest xorg-server-source is picked up, but it also includes a version requirement that ensures that any version of xorg-server-source with the aforementioned CVE will *not* be used during the build.

[ Test Plan ]

1: Install TigerVNC server on one machine or VM on the local network.
2: Install TigerVNC client on another machine or VM on the local network.
3: Attempt to remote into the server machine from the cilent and ensure that basic VNC functionality works.

[ Where problems could occur ]

A typo or accident made during the packaging procedure could result in an FTBFS condition or cause TigerVNC to not function correctly any longer. The newer versions of software TigerVNC is going to be built against could cause similar issues. The test plan and careful review of the debdiffs should avoid this. As this is virtually identical to a no-change rebuild, I do not expect this to have a high likelihood of going wrong.

-----

Old bug report:

Debian have released a fix to tigervnc for CVE-2023-1393 - see
 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1051921
It would be good if this security fix was available in Ubuntu too.

ProblemType: Bug
DistroRelease: Ubuntu 23.10
Package: tigervnc-standalone-server 1.12.0+dfsg-8
ProcVersionSignature: Ubuntu 6.5.0-14.14-generic 6.5.3
Uname: Linux 6.5.0-14-generic x86_64
ApportVersion: 2.27.0-0ubuntu5
Architecture: amd64
CasperMD5CheckResult: unknown
Date: Sat Jan 6 21:41:15 2024
InstallationDate: Installed on 2018-12-01 (1862 days ago)
InstallationMedia: Lubuntu 18.04 LTS "Bionic Beaver" - Release amd64 (20180426)
SourcePackage: tigervnc
UpgradeStatus: Upgraded to mantic on 2020-11-06 (1156 days ago)

[Marc Deslauriers (mdeslaur)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

[Aaron Rainbolt (arraybolt3)]

The fix for this bug in Debian is already present in Noble, so marking it as "Fix Released" so that the SRUs for older releases can proceed as intended.

[Aaron Rainbolt (arraybolt3)]

Debdiff for Mantic.

[Aaron Rainbolt (arraybolt3)]

Debdiff for Lunar.

[Aaron Rainbolt (arraybolt3)]

Debdiff for Jammy.

[Aaron Rainbolt (arraybolt3)]

Debdiff for Focal. (This took a while longer to prep than the others because I ended up having to spin up a whole new build environment thanks to the fact that the Focal package still uses CDBS.)

[Marc Deslauriers (mdeslaur)]

ACK on the debdiffs. At first I thought the version used for xorg-server in lunar and mantic looked odd, but that's because the package was last rebuilt before lunar's release, so it makes sense.

I have changed the pocket to -security, and have uploaded them to the following PPA for testing:

https://launchpad.net/~ubuntu-security-proposed/+archive/ubuntu/ppa/+packages

Once you have tested them, please comment in this bug and I will release them as security updates.

Thanks!

[Aaron Rainbolt (arraybolt3)]

TigerVNC on Mantic functions as expected. Took me a while to figure out how to set it up, but once I got it sorted it works nicely.

[Aaron Rainbolt (arraybolt3)]

TigerVNC on Lunar functions as expected.

[Aaron Rainbolt (arraybolt3)]

TigerVNC on Jammy functions as expected.

[Aaron Rainbolt (arraybolt3)]

TigerVNC on Focal works as expected (I wasn't able to figure out how to get a true Lubuntu session up and running in it, but an LXQt session is close enough (themed funky but whatever), and I'm pretty sure I just don't know what config option to change to get a true Lubuntu session going with this old of a version of TigerVNC).

[Launchpad Janitor (janitor)]

This bug was fixed in the package tigervnc - 1.12.0+dfsg-8ubuntu0.23.04.1

---------------
tigervnc (1.12.0+dfsg-8ubuntu0.23.04.1) lunar-security; urgency=medium

  * SECURITY UPDATE: Enforce building of TigerVNC against a version of
    xorg-server-source that is not vulnerable to CVE-2023-1393.
    (LP: #2048442)

 -- Aaron Rainbolt <email address hidden> Tue, 23 Jan 2024 17:21:24 +0000

[Launchpad Janitor (janitor)]

This bug was fixed in the package tigervnc - 1.12.0+dfsg-4ubuntu0.22.04.1

---------------
tigervnc (1.12.0+dfsg-4ubuntu0.22.04.1) jammy-security; urgency=medium

  * SECURITY UPDATE: Enforce building of TigerVNC against a version of
    xorg-server-source that is not vulnerable to CVE-2023-1393.
    (LP: #2048442)

 -- Aaron Rainbolt <email address hidden> Tue, 23 Jan 2024 19:20:24 +0000

[Launchpad Janitor (janitor)]

This bug was fixed in the package tigervnc - 1.12.0+dfsg-8ubuntu0.23.10.1

---------------
tigervnc (1.12.0+dfsg-8ubuntu0.23.10.1) mantic-security; urgency=medium

  * SECURITY UPDATE: Enforce building of TigerVNC against a version of
    xorg-server-source that is not vulnerable to CVE-2023-1393.
    (LP: #2048442)

 -- Aaron Rainbolt <email address hidden> Tue, 23 Jan 2024 17:21:24 +0000

[Launchpad Janitor (janitor)]

This bug was fixed in the package tigervnc - 1.10.1+dfsg-3ubuntu0.20.04.1

---------------
tigervnc (1.10.1+dfsg-3ubuntu0.20.04.1) focal-security; urgency=medium

  * SECURITY UPDATE: Enforce building of TigerVNC against a version of
    xorg-server-source that is not vulnerable to CVE-2023-1393.
    (LP: #2048442)

 -- Aaron Rainbolt <email address hidden> Tue, 23 Jan 2024 14:31:07 -0600