Lucene search

[email protected]CVE-2002-1336

HistoryDec 11, 2002 - 5:00 a.m.

CVE-2002-1336

2002-12-1105:00:00

NVD-CWE-Other

[email protected]

web.nvd.nist.gov

tightvnc

1.2.6

authentication bypass

remote attackers

nvd

7.2 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.005 Low

EPSS

Percentile

75.1%

JSON

TightVNC before 1.2.6 generates the same challenge string for multiple connections, which allows remote attackers to bypass VNC authentication by sniffing the challenge and response of other users.

CPENameOperatorVersion
tightvnc:tightvnctightvnceq1.2.4
tightvnc:tightvnctightvnceq1.2.0
tightvnc:tightvnctightvnceq1.2.1
tightvnc:tightvnctightvnceq1.2.3
tightvnc:tightvnctightvnceq1.2.5

CPE	Name	Operator	Version
tightvnc:tightvnc	tightvnc	eq	1.2.4
tightvnc:tightvnc	tightvnc	eq	1.2.0
tightvnc:tightvnc	tightvnc	eq	1.2.1
tightvnc:tightvnc	tightvnc	eq	1.2.3
tightvnc:tightvnc	tightvnc	eq	1.2.5

References

distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000640

marc.info/?l=bugtraq&m=102753170201524&w=2

marc.info/?l=bugtraq&m=102769183913594&w=2

www.mandrakesoft.com/security/advisories?name=MDKSA-2003:022

www.redhat.com/support/errata/RHSA-2002-287.html

www.redhat.com/support/errata/RHSA-2003-041.html

www.securityfocus.com/bid/5296

www.tightvnc.com/WhatsNew.txt

exchange.xforce.ibmcloud.com/vulnerabilities/5992

7.2 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.005 Low

EPSS

Percentile

75.1%

JSON

Related for CVE-2002-1336

debiancve1 nessus2