Re: RealVNC 4.1.1 Remote Compromise

[Michael Holstein <michael.holstein () csuohio edu>]

> So what can be done about this exploit?  Does 4.1.2 protect against this
> vulnerability?  And what other mitigation procedures are available for
> this?

Well, VNC hasn't exactly been legendary for security .. but if you do 
run it, one safe(er) way to do so is bind VNC to localhost, and use sshd 
and port-redirection to access it.

Of course, then you've got to pay attention to patches in OpenSSH, but 
that's got a better track record, and allows you to do RSA auth, etc.

Cheers,

Michael Holstein CISSP GCIA
Cleveland State University

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/