full-disclosure - RealVNC/WinVNC Multiple vulnerabilities

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <42B5828B.7000103@phreaker.net>
Date: Sun Jun 19 15:38:29 2005
From: class101 at phreaker.net (class101@...eaker.net)
Subject: RealVNC/WinVNC Multiple vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Two simple vulnerabilities wich may lead to an os guess + null session
+ several others infos while scanning port 5900,
low risk on paper but high online risk:

My 2cent suggestion to the realvnc team would be to totally remove
this "No Authentication" option wich wasnt present in the oldold
winvnc, and to standardize what is answering all your servers to
restrict the private informations guessing.

quick screenshot( of a simple dfind scanning test on a range that I
thought really secured :>):

***.7.41:5900   realvnc4 ssl encryption
***.16.83:5900   realvnc4 passworded (free ed. win32)
***.16.91:5900   realvnc4 passworded (free ed. win32)
***.16.113:5900   realvnc4 passworded (free ed. win32)
***.16.163:5900   realvnc4 passworded (free ed. x86/SPARC/HPUX)
***.16.180:5900   realvnc4 passworded (free ed. x86/SPARC/HPUX)
***.16.202:5900   RealVNC4 NULL Session (free ed. x86/SPARC/HPUX)
***.16.237:5900   realvnc4 passworded (free ed. x86/SPARC/HPUX)
***.22.217:5900   realvnc4 passworded (free ed. x86/SPARC/HPUX)
***.29.91:5900   realvnc4 passworded (free ed. x86/SPARC/HPUX)
***.29.92:5900   RealVNC4 NULL Session (perso/enterp ed. win32
encryption:OFF)
***.29.93:5900   realvnc4 passworded (free ed. x86/SPARC/HPUX)
***.29.157:5900   realvnc4 passworded (perso/enterp ed. win32
encryption:OFF)
***.29.201:5900   realvnc4 passworded (free ed. x86/SPARC/HPUX)
***.29.234:5900   realvnc4 passworded (free ed. win32)
***.35.45:5900   realvnc4 passworded (perso/enterp ed. win32
encryption:ON)
***.40.192:5900   RealVNC4 NULL Session (perso/enterp ed. win32
encryption:ON)

If you are seeking for more informations and you are from
@realvnc.com, email me, or else look at class101.org and hat-squad.com

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (MingW32)

iD8DBQFCtYKCLyZ8K9aT7rARAli2AKCKY7EWdCDtKy4QMTnMfZTjPbvL4QCgtAbf
bQFC+7siFcPyvRWx1J0Cd2I=
=9JZg
-----END PGP SIGNATURE-----