haskal
/
kicad
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

The listener is opened on INADDR_ANY, so it will accept any network 

connection, no matter if it is originating locally or from the outside
of the host. There is no check in place to discard non-local
connections. The only security against a malicious attack would be
provided by a local firewall, which is not guaranteed to be installed on
every workstation kicad is used on.

I tested this, and a host running eeschema accepts connections on TCP
port 4243 from other hosts on the internet.

A patch to remedy this potentially serious security hole is attached. It
creates the listener on localhost instead. A flag is provided to allow
the creation of sockets on 0.0.0.0 instead, if required. localhost is
the default.
This commit is contained in:
Gregor Riepl 2012-08-24 06:19:52 -05:00 committed by Dick Hollenbeck
parent 3a07ab1f09
commit 96771ccc03
2 changed files with 5 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
common/eda_dde.cpp
View File

@ -35,12 +35,15 @@ void SetupServerFunction( void (*remotefct)(const char* remotecmd) )
/* Function to initialize a server socket /* Function to initialize a server socket
*/ */
WinEDA_Server* CreateServer( wxWindow* window, int service ) WinEDA_Server* CreateServer( wxWindow* window, int service, bool local )
{ {
wxIPV4address addr; wxIPV4address addr;
// Create a new server // Create a new server
addr.Service( service ); addr.Service( service );
// Listen on localhost only if requested
if( local )
addr.Hostname( HOSTNAME );
server = new wxServer( addr ); server = new wxServer( addr );

2
include/eda_dde.h
View File

@ -30,7 +30,7 @@
/* autres fonctions */ /* autres fonctions */
/********************/ /********************/
WinEDA_Server * CreateServer( wxWindow * window, int port ); WinEDA_Server * CreateServer( wxWindow * window, int port, bool local = true );
bool SendCommand( int port, const char* cmdline ); bool SendCommand( int port, const char* cmdline );
void SetupServerFunction( void (*remotefct) (const char* remotecmd) ); void SetupServerFunction( void (*remotefct) (const char* remotecmd) );