WARN: RealVNC Vulnerability

Capt_Caveman · 05-16-2006, 06:17 PM

A vulnerability has been identified in RealVNC that allows a remote user to bypass authentication without providing a correct password. A working proof-of-concept has been released and exploits are actively circulating in the wild. This vulnerability only appears to affect RealVNC version 4.1.1 and not older versions or other VNC daemons such as Ultra or TightVNC.

http://www.intelliadmin.com/blog/200...alvnc-411.html
http://www.linuxsecurity.com/content/view/122774/65/
http://secunia.com/advisories/20107/

gilead · 05-16-2006, 06:24 PM

We use VNC here as part of the corporate standard operating environment. The solution here hasn't been to upgrade VNC (or block it across the network until it's patched) - instead, the sites describing the problem have been blocked at our proxy server so nobody can read about it.

Looks like I have to wait until I get home tonight to read about this...

Capt_Caveman · 05-17-2006, 04:29 PM

Quote:

Originally Posted by gilead

We use VNC here as part of the corporate standard operating environment. The solution here hasn't been to upgrade VNC (or block it across the network until it's patched) - instead, the sites describing the problem have been blocked at our proxy server so nobody can read about it.

Ahh the ole' "Stick Head in Sand" approach to security. I don't think I'd really consider that a "solution" by any stretch of the word. Hopefully the can get a real solution/workaround soon.

soulestream · 05-19-2006, 08:57 PM

once again. thats why you use VPN -> vnc. RDP has a similar issue in which the encryption can be cracked on the fly.

Soule

Capt_Caveman · 05-19-2006, 09:45 PM

Agreed. Or VNC over SSH.

gilead · 05-19-2006, 11:38 PM

The corporate response here hasn't been decided yet - or if it has, the staff haven't been told. I use VNC over SSH when connecting to the Linux boxes, but the Windows boxes are mostly workstations without SSH. Fortunately, none of them are visible outside the LAN.

Capt_Caveman · 05-22-2006, 08:16 PM

That's good, because there has been huge amounts of scanning for VNC ports lately. They should get on the stick though, as the exploit is reportedly extremely easy to implement. Especially if you have untrusted or quasi-trusted users on the network.