bugtraq - Re: [Full-disclosure] RealVNC 4.1.1 Remote Compromise

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Mon, 5 Jun 2006 17:33:29 -0600
From: "Kurt Seifried" <bt@...fried.org>
To: "Tobias Kreidl" <Tobias.Kreidl@....EDU>
Cc: <bugtraq@...urityfocus.com>
Subject: Re: [Full-disclosure] RealVNC 4.1.1 Remote Compromise

> How is it that even though this vulnerability has been known now for
> some time, Red Hat still has not issued a new package or security update
> that addresses this?  On RHN, the most recent package I can find is
> 4.0.0 beta and the most recent security patch for VNC dates back to
> December 2004.  Since Red Hat started distributing the package, why has
> it not been kept up with?

Probably because customers are not bugging them to much for it?  I've never 
used vnc-server on Linux or seen it used to be honest, and although it is a 
nasty problem it's easy to deal with (just firewall it to trusted systems or 
wrap a VPN around it). They are obviously aware of this issue (it was fixed 
in Fedora Core 5, reported by Mark J. Cox).

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=191692

-Kurt