full-disclosure - RE: RealVNC/WinVNC Multiple vulnerabilities

Open Source and information security mailing list archives

Message-ID: <200506201334.j5KDYMv32156@realvnc.com>
Date: Tue Jun 21 01:04:39 2005
From: jnw at realvnc.com (James Weatherall)
Subject: RE: RealVNC/WinVNC Multiple vulnerabilities

"Class101",

VNC has always provided the option to operate without requiring
authentication, there is no such thing as a "RealVNC4 NULL Session", and VNC
has never used SSL encryption, so I'm afraid it sounds like someone's been
telling you porkies!

The output that you've included just seems to show that (assuming
"passworded" means "was able to guess password") your VNC Servers have been
configured with poorly chosen passwords.

Of course, if you think you know of any viable attacks on VNC servers then
feel free to get in touch.

Cheers,

Wez @ RealVNC Ltd.

> -----Original Message-----
> From: vnc-list-admin@...lvnc.com 
> [mailto:vnc-list-admin@...lvnc.com] On Behalf Of class101@...eaker.net
> Sent: 19 June 2005 15:35
> To: vnc-list@...lvnc.com
> Cc: Full-Disclosure
> Subject: RealVNC/WinVNC Multiple vulnerabilities
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>  
> Two simple vulnerabilities wich may lead to an os guess + null session
> + several others infos while scanning port 5900,
> low risk on paper but high online risk:
> 
> My 2cent suggestion to the realvnc team would be to totally remove
> this "No Authentication" option wich wasnt present in the oldold
> winvnc, and to standardize what is answering all your servers to
> restrict the private informations guessing.
> 
> 
> quick screenshot( of a simple dfind scanning test on a range that I
> thought really secured :>):
> 
> ***.7.41:5900   realvnc4 ssl encryption
> ***.16.83:5900   realvnc4 passworded (free ed. win32)
> ***.16.91:5900   realvnc4 passworded (free ed. win32)
> ***.16.113:5900   realvnc4 passworded (free ed. win32)
> ***.16.163:5900   realvnc4 passworded (free ed. x86/SPARC/HPUX)
> ***.16.180:5900   realvnc4 passworded (free ed. x86/SPARC/HPUX)
> ***.16.202:5900   RealVNC4 NULL Session (free ed. x86/SPARC/HPUX)
> ***.16.237:5900   realvnc4 passworded (free ed. x86/SPARC/HPUX)
> ***.22.217:5900   realvnc4 passworded (free ed. x86/SPARC/HPUX)
> ***.29.91:5900   realvnc4 passworded (free ed. x86/SPARC/HPUX)
> ***.29.92:5900   RealVNC4 NULL Session (perso/enterp ed. win32
> encryption:OFF)
> ***.29.93:5900   realvnc4 passworded (free ed. x86/SPARC/HPUX)
> ***.29.157:5900   realvnc4 passworded (perso/enterp ed. win32
> encryption:OFF)
> ***.29.201:5900   realvnc4 passworded (free ed. x86/SPARC/HPUX)
> ***.29.234:5900   realvnc4 passworded (free ed. win32)
> ***.35.45:5900   realvnc4 passworded (perso/enterp ed. win32
> encryption:ON)
> ***.40.192:5900   RealVNC4 NULL Session (perso/enterp ed. win32
> encryption:ON)
> 
> If you are seeking for more informations and you are from
> @realvnc.com, email me, or else look at class101.org and hat-squad.com
> 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.1 (MingW32)
>  
> iD8DBQFCtYKCLyZ8K9aT7rARAli2AKCKY7EWdCDtKy4QMTnMfZTjPbvL4QCgtAbf
> bQFC+7siFcPyvRWx1J0Cd2I=
> =9JZg
> -----END PGP SIGNATURE-----
> _______________________________________________
> VNC-List mailing list
> VNC-List@...lvnc.com
> To remove yourself from the list visit:
> http://www.realvnc.com/mailman/listinfo/vnc-list
> 

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives