FvwmButtons listens for incoming TCP connections

[vladrich]

Hello,

I cannot find a dedicated security contact, so I am posting this here.

FvwmButtons listens for incoming TCP connections from any host, which is a major security risk.

# netstat -ltpv 
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:38221           0.0.0.0:*               LISTEN      15701/FvwmButtons   
tcp6       0      0 [::]:42179              [::]:*                  LISTEN      15701/FvwmButtons   

Running on Linux x86_64.

As far as I can see, the port is opened here:

fvwm3/libs/fsm.c

Line 1046 in 5d6c045

if (!FIceListenForConnections (

Others seem to be mitigating the problem by limiting communication to UNIX sockets via calling _IceTransNoListen ("tcp")

Can FVWM do the same?

Thanks,
V.

[ThomasAdam]

Hi @vladrich

This is a very old bug.

Open a PR to fix this, please.

[vladrich]

I've tried with #1030 now. Please check carefully - I am not fluent at C programming. Thanks!