net-misc/vnc/files/vnc-3.3.7-gentoo.security.patch


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

--- /tmp/vncserver	2003-02-21 17:47:11.000000000 +0000
+++ vncserver	2003-02-21 17:47:41.000000000 +0000
@@ -120,15 +120,8 @@
 $desktopLog = "$vncUserDir/$host:$displayNumber.log";
 unlink($desktopLog);
 
-# Make an X server cookie - use as the seed the sum of the current time, our
-# PID and part of the encrypted form of the password.  Ideally we'd use
-# /dev/urandom, but that's only available on Linux.
-
-srand(time+$$+unpack("L",`cat $vncUserDir/passwd`));
-$cookie = "";
-for (1..16) {
-    $cookie .= sprintf("%02x", int(rand(256)) % 256);
-}
+# Make an X server cookie - use mcookie
+$cookie = `/usr/bin/mcookie`;
     
 system("xauth -f $xauthorityFile add $host:$displayNumber . $cookie");
 system("xauth -f $xauthorityFile add $host/unix:$displayNumber . $cookie");