Message-ID: <200506201545.j5KFj5v17916@realvnc.com>
Date: Tue Jun 21 01:05:16 2005
From: jnw at realvnc.com (James Weatherall)
Subject: RE: RealVNC/WinVNC Multiple vulnerabilities

"Class101",

Sorry, perhaps I wasn't clear:  There are valid reasons for wanting to run
servers without requiring authentication of viewers.  Have you asked the
people who's servers you're scanning whether they intended them to be
configured that way?

Cheers,

Wez @ RealVNC Ltd.


> -----Original Message-----
> From: class [mailto:ad@...ss101.org] 
> Sent: 20 June 2005 16:34
> To: James Weatherall
> Cc: vnc-list@...lvnc.com; 'Full-Disclosure'
> Subject: Re: RealVNC/WinVNC Multiple vulnerabilities
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>  
> > As I've stated previously, "No Authentication" must be explicitly
> > configured and is not enabled by default. What makes you think the
> > servers in question aren't intended to be configured that way?
> 
> yep why not, assuming there is so dumb peoples, they will be owned
> very soon is my guess with or without my scan, its up to everyone
> knowing c to scan this
> .
> James Weatherall a ?crit :
> 
> > FYI, "passworded means it's passworded" isn't really a very helpful
> > description, given that "password" is a noun! It sounds like
> > dfind's developers really mean "Is configured to require a
> > password". Again, you may wish to suggest a change of text to
> > them.
> 
> thats why it's displayed only when you -vv (hardverbose, else all go
> to the file), anyway looks like you wont remove it so keep up the good
> work on vnc, a pity that weakness,...
> how many admins are knowing that they are running their vnc without
> any passwords, it shouldnt be so low man regarding the high number of
> "no auth" :)
> 
> 
> annyway cheers and sorry for the crap language I have.
> > "class101",
> >
> > As I've stated previously, "No Authentication" must be explicitly
> > configured and is not enabled by default. What makes you think the
> > servers in question aren't intended to be configured that way?
> >
> > FYI, "passworded means it's passworded" isn't really a very helpful
> > description, given that "password" is a noun! It sounds like
> > dfind's developers really mean "Is configured to require a
> > password". Again, you may wish to suggest a change of text to
> > them.
> >
> > Cheers,
> >
> > Wez @ RealVNC Ltd.
> >
> >
> >> -----Original Message----- From: class [mailto:ad@...ss101.org]
> >> Sent: 20 June 2005 15:58 Cc: James Weatherall;
> >> vnc-list@...lvnc.com; 'Full-Disclosure' Subject: Re:
> >> RealVNC/WinVNC Multiple vulnerabilities
> >>
> 
> >
> >> Of course, if you think you know of any viable attacks on VNC
> >> servers then feel free to get in touch.
> >
> > sure I have mailed you a nice list of ip:5900 shomydeskt0p :) funny
> > no ? good lines ? ;)
> >
> >> The output that you've included just seems to show that (assuming
> >> "passworded" means "was able to guess password") your VNC
> >> Servers have been configured with poorly chosen passwords.
> >
> > passworded mean its passworded , nothing much, my scan doesnt
> > include any password brteforce, but it show you how easy it is to
> > scan for your app with "No authentications", who is enough crazy
> > thos days to add such options ? so easy hacking :)
> >
> >>> The output that you've included just seems to show that
> >>> (assuming "passworded" means "was able to guess password") your
> >>> VNC Servers have been configured with poorly chosen passwords.
> >
> >
> >
> >
> >
> >>>> -----Original Message----- From: vnc-list-admin@...lvnc.com
> >>>> [mailto:vnc-list-admin@...lvnc.com] On Behalf Of
> >>>> class101@...eaker.net Sent: 19 June 2005 15:35 To:
> >>>> vnc-list@...lvnc.com Cc: Full-Disclosure Subject:
> >>>> RealVNC/WinVNC Multiple vulnerabilities
> >>>>
> >>> Two simple vulnerabilities wich may lead to an os guess + null
> >>> session + several others infos while scanning port 5900, low
> >>> risk on paper but high online risk:
> >
> >>> My 2cent suggestion to the realvnc team would be to totally
> >>> remove this "No Authentication" option wich wasnt present in
> >>> the oldold winvnc, and to standardize what is answering all
> >>> your servers to restrict the private informations guessing.
> >
> >
> >>> quick screenshot( of a simple dfind scanning test on a range
> >>> that I thought really secured :>):
> >
> >>> ***.7.41:5900 realvnc4 ssl encryption ***.16.83:5900 realvnc4
> >>> passworded (free ed. win32) ***.16.91:5900 realvnc4 passworded
> >>> (free ed. win32) ***.16.113:5900 realvnc4 passworded (free ed.
> >>> win32) ***.16.163:5900 realvnc4 passworded (free ed.
> >>> x86/SPARC/HPUX) ***.16.180:5900 realvnc4 passworded (free ed.
> >>> x86/SPARC/HPUX) ***.16.202:5900 RealVNC4 NULL Session (free ed.
> >>> x86/SPARC/HPUX) ***.16.237:5900 realvnc4 passworded (free ed.
> >>> x86/SPARC/HPUX) ***.22.217:5900 realvnc4 passworded (free ed.
> >>> x86/SPARC/HPUX) ***.29.91:5900 realvnc4 passworded (free ed.
> >>> x86/SPARC/HPUX) ***.29.92:5900 RealVNC4 NULL Session
> >>> (perso/enterp ed. win32 encryption:OFF) ***.29.93:5900 realvnc4
> >>> passworded (free ed. x86/SPARC/HPUX) ***.29.157:5900 realvnc4
> >>> passworded (perso/enterp ed. win32 encryption:OFF)
> >>> ***.29.201:5900 realvnc4 passworded (free ed. x86/SPARC/HPUX)
> >>> ***.29.234:5900 realvnc4 passworded (free ed. win32)
> >>> ***.35.45:5900 realvnc4 passworded (perso/enterp ed. win32
> >>> encryption:ON) ***.40.192:5900 RealVNC4 NULL Session
> >>> (perso/enterp ed. win32 encryption:ON)
> >
> >>> If you are seeking for more informations and you are from
> >>> @realvnc.com, email me, or else look at class101.org and
> >>> hat-squad.com
> >
> >> _______________________________________________ VNC-List mailing
> >> list VNC-List@...lvnc.com To remove yourself from the list visit:
> >> http://www.realvnc.com/mailman/listinfo/vnc-list
> >
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.1 (MingW32)
>  
> iD8DBQFCtuHuLyZ8K9aT7rARAoKgAJwKGCWNveiuiOEkrzdPApCpSKegOQCgsjiR
> xa8MeTetlnH2GvFsYIWOIxk=
> =pff0
> -----END PGP SIGNATURE-----
> 
> 

Powered by blists - more mailing lists