bugtraq - unauthorized VNC access in AK-Systems Windows Terminals

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20060822091105.GA20868@admin.sibptus.tomsk.ru>
Date: Tue, 22 Aug 2006 16:11:05 +0700
From: Victor Sudakov <sudakov@...ptus.tomsk.ru>
To: bugtraq@...urityfocus.com
Subject: unauthorized VNC access in AK-Systems Windows Terminals

WinCE-based Windows Terminals (thin clients) manufactured by
AK-Systems (http://www.ak-systems.ru/) with firmware version 1.2.5 ExVLP
feature a VNC server for remote administration and setup. The VNC
access is not protected by password, so anyone with a VNC client can
connect to the terminal and watch the user's RDP/Citrix session, or even
meddle into it.

Workaround suggested by vendor: older firmware without VNC support
should be installed on the terminal.

-- 
Victor Sudakov,  VAS4-RIPE, VAS47-RIPN
sip:sudakov@...ptus.tomsk.ru