CVE-2001-1422

The CVE-2001-1422 entry concerns WinVNC 3.3.3 and earlier, where generating the same challenge string for multiple connections allows remote attackers to bypass VNC authentication by sniffing the challenge/response of other users. Affected software: WinVNC versions up to 3.3.3 (and earlier). Unde...

CVE-2004-1750

RealVNC 4.0 and earlier allows remote attackers to cause a denial of service crash via a large number of connections to port 5900...

Hydra: VNC

This plugin runs Hydra to find VNC passwords by brute force. To use this plugin, enter the 'Logins file' and the 'Passwords file' under the 'Hydra NASL wrappers options' advanced settings block. TRUSTED...

CVE-2002-1511

The vncserver wrapper for vnc before 3.3.3r2-21 uses the rand function instead of srand, which causes vncserver to generate weak cookies...

CVE-2002-1336

TightVNC before 1.2.6 generates the same challenge string for multiple connections, which allows remote attackers to bypass VNC authentication by sniffing the challenge and response of other users...

CVE-2002-1336

TightVNC before 1.2.6 generates the same challenge string for multiple connections, which allows remote attackers to bypass VNC authentication by sniffing the challenge and response of other users...

VNC Detection (deprecated)

Binary data 1882.prm...

Mandrake Linux Security Advisory : vnc (MDKSA-2003:022)

A vulnerability was discovered in the VNC server script that generates an X cookie, used by X authentication. The script generated a cookie that was not strong enough and allow an attacker to more easily guess the authentication cookie, thus obtaining unauthorized access to the VNC server...

RHEL 2.1 : vnc (RHSA-2003:068)

Updated VNC packages are available to fix a weak cookie vulnerability. VNC is a tool for providing a remote graphical user interface. The VNC server acts as an X server, but the script for starting it generates an MIT X cookie which is used for X authentication without using a strong enough rando...

RHEL 2.1 : vnc (RHSA-2002:287)

Updated VNC packages are available to fix a challenge replay attack that is present in the VNC server. VNC is a tool for providing a remote graphical user interface. The VNC DES authentication scheme is implemented using a challenge-response architecture, producing a random and different challeng...

[Full-Disclosure] SRT2004-01-17-0425 - Ultr@VNC local SYSTEM access.

Secure Network Operations, Inc. http://www.secnetops.com/research Strategic Reconnaissance Team researchatsecnetops.com Team Lead Contact kfatsecnetops.com Spam Contact rm -rf /@snosoft.com Our Mission: Secure Network Operations offers expertise in Networking, Intrusion Detection Systems IDS,...

Moderate: Red Hat Security Advisory: vnc security update

Updated VNC packages are available to fix a weak cookie vulnerability. VNC is a tool for providing a remote graphical user interface. The VNC server acts as an X server, but the script for starting it generates an MIT X cookie which is used for X authentication without using a strong enough rando...

Moderate: Red Hat Security Advisory: : : : Updated VNC packages fix replay and cookie vulnerabilities

Updated VNC packages are available, fixing a challenge replay and a weak cookie vulnerability. Updated 10 July 2003 Added packages for Red Hat Linux on IBM iSeries and pSeries systems. VNC is a tool for providing a remote graphical user interface. Two vulnerabilities have been found in versions o...

Moderate: Red Hat Security Advisory: vnc security update

Updated VNC packages are available to fix a challenge replay attack that is present in the VNC server. VNC is a tool for providing a remote graphical user interface. The VNC DES authentication scheme is implemented using a challenge-response architecture, producing a random and different challeng...

CVE-2002-2088

The MOSIX Project clump/os 5.4 creates a default VNC account without a password, which allows remote attackers to gain root access...

DEBIAN-CVE-2002-1336

TightVNC before 1.2.6 generates the same challenge string for multiple connections, which allows remote attackers to bypass VNC authentication by sniffing the challenge and response of other users...

CVE-2002-1336

TightVNC before 1.2.6 generates the same challenge string for multiple connections, which allows remote attackers to bypass VNC authentication by sniffing the challenge and response of other users...

CVE-2002-0994

SunPCi II VNC uses a weak authentication scheme, which allows remote attackers to obtain the VNC password by sniffing the random byte challenge, which is used as the key for encrypted communications...

CVE-2002-0971

Vulnerability in VNC, TightVNC, and TridiaVNC allows local users to execute arbitrary code as LocalSystem by using the Win32 Messaging System to bypass the VNC GUI and access the "Add new clients" dialogue box...

CVE-2002-0994

Affected software: SunPCi II VNC. Vulnerability: weak authentication where the random byte challenge is used as the key for encrypted communications, enabling remote attackers to sniff the challenge and obtain the VNC password. Impact (as stated): attacker can obtain credentials; confidentiality ...