RealVNC/WinVNC Multiple vulnerabilities

["class101 () phreaker net" <class101 () phreaker net>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
 
Two simple vulnerabilities wich may lead to an os guess + null session
+ several others infos while scanning port 5900,
low risk on paper but high online risk:

My 2cent suggestion to the realvnc team would be to totally remove
this "No Authentication" option wich wasnt present in the oldold
winvnc, and to standardize what is answering all your servers to
restrict the private informations guessing.


quick screenshot( of a simple dfind scanning test on a range that I
thought really secured :>):

***.7.41:5900   realvnc4 ssl encryption
***.16.83:5900   realvnc4 passworded (free ed. win32)
***.16.91:5900   realvnc4 passworded (free ed. win32)
***.16.113:5900   realvnc4 passworded (free ed. win32)
***.16.163:5900   realvnc4 passworded (free ed. x86/SPARC/HPUX)
***.16.180:5900   realvnc4 passworded (free ed. x86/SPARC/HPUX)
***.16.202:5900   RealVNC4 NULL Session (free ed. x86/SPARC/HPUX)
***.16.237:5900   realvnc4 passworded (free ed. x86/SPARC/HPUX)
***.22.217:5900   realvnc4 passworded (free ed. x86/SPARC/HPUX)
***.29.91:5900   realvnc4 passworded (free ed. x86/SPARC/HPUX)
***.29.92:5900   RealVNC4 NULL Session (perso/enterp ed. win32
encryption:OFF)
***.29.93:5900   realvnc4 passworded (free ed. x86/SPARC/HPUX)
***.29.157:5900   realvnc4 passworded (perso/enterp ed. win32
encryption:OFF)
***.29.201:5900   realvnc4 passworded (free ed. x86/SPARC/HPUX)
***.29.234:5900   realvnc4 passworded (free ed. win32)
***.35.45:5900   realvnc4 passworded (perso/enterp ed. win32
encryption:ON)
***.40.192:5900   RealVNC4 NULL Session (perso/enterp ed. win32
encryption:ON)

If you are seeking for more informations and you are from
@realvnc.com, email me, or else look at class101.org and hat-squad.com

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (MingW32)
 
iD8DBQFCtYKCLyZ8K9aT7rARAli2AKCKY7EWdCDtKy4QMTnMfZTjPbvL4QCgtAbf
bQFC+7siFcPyvRWx1J0Cd2I=
=9JZg
-----END PGP SIGNATURE-----


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/