RE: RealVNC/WinVNC Multiple vulnerabilities

["James Weatherall" <jnw () realvnc com>]

"Class101",

VNC has always provided the option to operate without requiring
authentication, there is no such thing as a "RealVNC4 NULL Session", and VNC
has never used SSL encryption, so I'm afraid it sounds like someone's been
telling you porkies!

The output that you've included just seems to show that (assuming
"passworded" means "was able to guess password") your VNC Servers have been
configured with poorly chosen passwords.

Of course, if you think you know of any viable attacks on VNC servers then
feel free to get in touch.

Cheers,

Wez @ RealVNC Ltd.


> -----Original Message-----
> From: vnc-list-admin () realvnc com 
> [mailto:vnc-list-admin () realvnc com] On Behalf Of class101 () phreaker net
> Sent: 19 June 2005 15:35
> To: vnc-list () realvnc com
> Cc: Full-Disclosure
> Subject: RealVNC/WinVNC Multiple vulnerabilities
>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>  
> Two simple vulnerabilities wich may lead to an os guess + null session
> + several others infos while scanning port 5900,
> low risk on paper but high online risk:
>
> My 2cent suggestion to the realvnc team would be to totally remove
> this "No Authentication" option wich wasnt present in the oldold
> winvnc, and to standardize what is answering all your servers to
> restrict the private informations guessing.
>
>
> quick screenshot( of a simple dfind scanning test on a range that I
> thought really secured :>):
>
> ***.7.41:5900   realvnc4 ssl encryption
> ***.16.83:5900   realvnc4 passworded (free ed. win32)
> ***.16.91:5900   realvnc4 passworded (free ed. win32)
> ***.16.113:5900   realvnc4 passworded (free ed. win32)
> ***.16.163:5900   realvnc4 passworded (free ed. x86/SPARC/HPUX)
> ***.16.180:5900   realvnc4 passworded (free ed. x86/SPARC/HPUX)
> ***.16.202:5900   RealVNC4 NULL Session (free ed. x86/SPARC/HPUX)
> ***.16.237:5900   realvnc4 passworded (free ed. x86/SPARC/HPUX)
> ***.22.217:5900   realvnc4 passworded (free ed. x86/SPARC/HPUX)
> ***.29.91:5900   realvnc4 passworded (free ed. x86/SPARC/HPUX)
> ***.29.92:5900   RealVNC4 NULL Session (perso/enterp ed. win32
> encryption:OFF)
> ***.29.93:5900   realvnc4 passworded (free ed. x86/SPARC/HPUX)
> ***.29.157:5900   realvnc4 passworded (perso/enterp ed. win32
> encryption:OFF)
> ***.29.201:5900   realvnc4 passworded (free ed. x86/SPARC/HPUX)
> ***.29.234:5900   realvnc4 passworded (free ed. win32)
> ***.35.45:5900   realvnc4 passworded (perso/enterp ed. win32
> encryption:ON)
> ***.40.192:5900   RealVNC4 NULL Session (perso/enterp ed. win32
> encryption:ON)
>
> If you are seeking for more informations and you are from
> @realvnc.com, email me, or else look at class101.org and hat-squad.com
>
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.1 (MingW32)
>  
> iD8DBQFCtYKCLyZ8K9aT7rARAli2AKCKY7EWdCDtKy4QMTnMfZTjPbvL4QCgtAbf
> bQFC+7siFcPyvRWx1J0Cd2I=
> =9JZg
> -----END PGP SIGNATURE-----
> _______________________________________________
> VNC-List mailing list
> VNC-List () realvnc com
> To remove yourself from the list visit:
> http://www.realvnc.com/mailman/listinfo/vnc-list

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/