Re: Re: RealVNC/WinVNC Multiple vulnerabilities

[Simon Roberts <thorpflyer () yahoo com>]

Can't say I agree that a VNC server implementation should simply refuse
to run in such a mode. There are plenty of situations where you being
able to get to my server implies that I've already suffered a massive
security breach anyway. Under those conditions, I think the "balance"
approach applies: let me use no authentication and maybe I'll use a
half-decent password, or put up with a "real" protection mechanism,
where it really matters. Like how I get in through my firewall, instead
of how I mess around inside it.

Even if this binary is fixed so no-auth isn't possible, if you're
letting your users configure this rather than giving it to them in a
centrally controlled fashion, then perhaps you already have worse
problems, like they can probably install their own software, etc...

Anyway, I guess my point is that it's my humble opinion that you don't
have the right to mandate the security vs. convenience balance for
everyone else.

Just $0.02, obviously,
Cheers,
Simon


--- class <ad () class101 org> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>  
> > Of course, if you think you know of any viable attacks on VNC
> > servers then feel free to get in touch.
>
> sure I have mailed you a nice list of ip:5900 shomydeskt0p :) funny
> no
> ? good lines ? ;)
>
> > The output that you've included just seems to show that (assuming
> > "passworded" means "was able to guess password") your VNC Servers
> > have been configured with poorly chosen passwords.
>
> passworded mean its passworded , nothing much, my scan doesnt include
> any password brteforce, but it show you how easy it is to scan for
> your app with "No authentications", who is enough crazy thos days to
> add such options ? so easy hacking :)
>
> > > The output that you've included just seems to show that (assuming
> > > "passworded" means "was able to guess password") your VNC
> > > Servers have been configured with poorly chosen passwords.
> >
> >
> >
> >
> >
> > > > -----Original Message----- From: vnc-list-admin () realvnc com
> > > > [mailto:vnc-list-admin () realvnc com] On Behalf Of
> > > > class101 () phreaker net Sent: 19 June 2005 15:35 To:
> > > > vnc-list () realvnc com Cc: Full-Disclosure Subject:
> > > > RealVNC/WinVNC Multiple vulnerabilities
> >
> > > Two simple vulnerabilities wich may lead to an os guess + null
> > > session + several others infos while scanning port 5900, low risk
> > > on paper but high online risk:
> >
> > > My 2cent suggestion to the realvnc team would be to totally
> > > remove this "No Authentication" option wich wasnt present in the
> > > oldold winvnc, and to standardize what is answering all your
> > > servers to restrict the private informations guessing.
> >
> >
> > > quick screenshot( of a simple dfind scanning test on a range that
> > > I thought really secured :>):
> >
> > > ***.7.41:5900 realvnc4 ssl encryption ***.16.83:5900 realvnc4
> > > passworded (free ed. win32) ***.16.91:5900 realvnc4 passworded
> > > (free ed. win32) ***.16.113:5900 realvnc4 passworded (free ed.
> > > win32) ***.16.163:5900 realvnc4 passworded (free ed.
> > > x86/SPARC/HPUX) ***.16.180:5900 realvnc4 passworded (free ed.
> > > x86/SPARC/HPUX) ***.16.202:5900 RealVNC4 NULL Session (free ed.
> > > x86/SPARC/HPUX) ***.16.237:5900 realvnc4 passworded (free ed.
> > > x86/SPARC/HPUX) ***.22.217:5900 realvnc4 passworded (free ed.
> > > x86/SPARC/HPUX) ***.29.91:5900 realvnc4 passworded (free ed.
> > > x86/SPARC/HPUX) ***.29.92:5900 RealVNC4 NULL Session
> > > (perso/enterp ed. win32 encryption:OFF) ***.29.93:5900 realvnc4
> > > passworded (free ed. x86/SPARC/HPUX) ***.29.157:5900 realvnc4
> > > passworded (perso/enterp ed. win32 encryption:OFF)
> > > ***.29.201:5900 realvnc4 passworded (free ed. x86/SPARC/HPUX)
> > > ***.29.234:5900 realvnc4 passworded (free ed. win32)
> > > ***.35.45:5900 realvnc4 passworded (perso/enterp ed. win32
> > > encryption:ON) ***.40.192:5900 RealVNC4 NULL Session
> > > (perso/enterp ed. win32 encryption:ON)
> >
> > > If you are seeking for more informations and you are from
> > > @realvnc.com, email me, or else look at class101.org and
> > > hat-squad.com
> >
> > _______________________________________________ VNC-List mailing
> > list VNC-List () realvnc com To remove yourself from the list visit:
> > http://www.realvnc.com/mailman/listinfo/vnc-list
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.1 (MingW32)
>  
> iD8DBQFCttl9LyZ8K9aT7rARApBzAJsHl81GPtNFi7tUeNIif8agJO2OoQCZAVjE
> QU7mktxxg1nZbPX+dLKuOqA=
> =gGqf
> -----END PGP SIGNATURE-----
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/


__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/