RealVNC Remote Authentication Bypass Vulnerability
BID:17978
CVE-2006-2369 |Info
RealVNC Remote Authentication Bypass Vulnerability
| Bugtraq ID: | 17978 |
| Class: | Design Error |
| CVE: |
CVE-2006-2369 |
| Remote: | Yes |
| Local: | No |
| Published: | May 15 2006 12:00AM |
| Updated: | Nov 15 2007 12:36AM |
| Credit: | Steve Wiseman discovered this vulnerability. |
| Vulnerable: |
RealVNC RealVNC Personal Edition 4.2.2 RealVNC RealVNC Personal Edition 4.2 RealVNC RealVNC Personal Edition 4.1 RealVNC RealVNC Personal Edition 4.0 RealVNC RealVNC Free Edition 4.1.1 RealVNC RealVNC Free Edition 4.1 RealVNC RealVNC Free Edition 4.0 RealVNC RealVNC Enterprise Edition 4.2.2 RealVNC RealVNC Enterprise Edition 4.2 RealVNC RealVNC Enterprise Edition 4.1 RealVNC RealVNC Enterprise Edition 4.0 Cisco IP/VC 3540/DCS 0 |
| Not Vulnerable: |
RealVNC RealVNC Personal Edition 4.2.3 RealVNC RealVNC Free Edition 4.1.2 RealVNC RealVNC Enterprise Edition 4.2.3 |
Discussion
RealVNC Remote Authentication Bypass Vulnerability
RealVNC is susceptible to an authentication-bypass vulnerability. This issue is due to a flaw in the authentication process of the affected package.
Exploiting this issue allows attackers to gain unauthenticated, remote access to the VNC servers.
RealVNC 4.1.1 is vulnerable to this issue; other versions may also be affected.
UPDATE (May 25, 2006): Reports indicate that this issue is being actively exploited in the wild.
RealVNC is susceptible to an authentication-bypass vulnerability. This issue is due to a flaw in the authentication process of the affected package.
Exploiting this issue allows attackers to gain unauthenticated, remote access to the VNC servers.
RealVNC 4.1.1 is vulnerable to this issue; other versions may also be affected.
UPDATE (May 25, 2006): Reports indicate that this issue is being actively exploited in the wild.
Exploit / POC
RealVNC Remote Authentication Bypass Vulnerability
To exploit this issue, attackers will likely modify readily available open-source VNC client software.
Exploit code is available by the reporter of this issue. It is not currently known to be publicly available.
HD Moore has provided an example using the Metasploit Framework. BL4CK has supplied a patch to VNC 4.1.1 to exploit this issue.
A scanner application is available by [email protected]. Note that Symantec has neither tested this scanner application nor verified it to be safe. Please see the references for more information.
A multi-threaded scanner application based on the [email protected] version is available from Matt Venzke. Note that Symantec has neither tested this scanner application nor verified it to be safe.
embyte has supplied a patch to VNC 4.1.1 to exploit this issue.
UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
To exploit this issue, attackers will likely modify readily available open-source VNC client software.
Exploit code is available by the reporter of this issue. It is not currently known to be publicly available.
HD Moore has provided an example using the Metasploit Framework. BL4CK has supplied a patch to VNC 4.1.1 to exploit this issue.
A scanner application is available by [email protected]. Note that Symantec has neither tested this scanner application nor verified it to be safe. Please see the references for more information.
A multi-threaded scanner application based on the [email protected] version is available from Matt Venzke. Note that Symantec has neither tested this scanner application nor verified it to be safe.
embyte has supplied a patch to VNC 4.1.1 to exploit this issue.
UPDATE: Core Security Technologies has developed a working commercial exploit for its CORE IMPACT product. This exploit is not otherwise publicly available or known to be circulating in the wild.
Solution / Fix
RealVNC Remote Authentication Bypass Vulnerability
Solution:
The vendor has released fixes to address this issue.
RealVNC RealVNC Enterprise Edition 4.1
RealVNC RealVNC Free Edition 4.1
RealVNC RealVNC Personal Edition 4.1
RealVNC RealVNC Enterprise Edition 4.0
Cisco IP/VC 3540/DCS 0
RealVNC RealVNC Free Edition 4.0
RealVNC RealVNC Personal Edition 4.0
RealVNC RealVNC Free Edition 4.1.1
Solution:
The vendor has released fixes to address this issue.
RealVNC RealVNC Enterprise Edition 4.1
-
Cisco win-OS-Upgrade-K9.2000-4-2sr8.exe
http://www.cisco.com/pcgi-bin/tablebuild.pl/cmva-3des
RealVNC RealVNC Free Edition 4.1
-
Cisco win-OS-Upgrade-K9.2000-4-2sr8.exe
http://www.cisco.com/pcgi-bin/tablebuild.pl/cmva-3des
RealVNC RealVNC Personal Edition 4.1
-
Cisco win-OS-Upgrade-K9.2000-4-2sr8.exe
http://www.cisco.com/pcgi-bin/tablebuild.pl/cmva-3des
RealVNC RealVNC Enterprise Edition 4.0
-
Cisco win-OS-Upgrade-K9.2000-4-2sr8.exe
http://www.cisco.com/pcgi-bin/tablebuild.pl/cmva-3des
Cisco IP/VC 3540/DCS 0
-
Cisco Update for IP/VC 3540/DCS
http://www.cisco.com/pcgi-bin/tablebuild.pl/ipvc
RealVNC RealVNC Free Edition 4.0
-
Cisco win-OS-Upgrade-K9.2000-4-2sr8.exe
http://www.cisco.com/pcgi-bin/tablebuild.pl/cmva-3des
RealVNC RealVNC Personal Edition 4.0
-
Cisco win-OS-Upgrade-K9.2000-4-2sr8.exe
http://www.cisco.com/pcgi-bin/tablebuild.pl/cmva-3des
RealVNC RealVNC Free Edition 4.1.1
-
Cisco win-OS-Upgrade-K9.2000-4-2sr8.exe
http://www.cisco.com/pcgi-bin/tablebuild.pl/cmva-3des
References
RealVNC Remote Authentication Bypass Vulnerability
References:
References:
- Cisco Security Response to: RealVNC Remote Authentication Bypass Vulnerability (Cisco)
- Cisco Security Response to: RealVNC Remote Authentication Bypass Vulnerability (Cisco)
- Metasploit RealVNC 4.1 Authentication Bypass (H D Moore)
- RealVNC Homepage (RealVNC)
- Security flaw in RealVNC 4.1.1 (Steve Wiseman)
- VNC 4.1 - Release Notes (RealVNC)
- VNC Enterprise Edition 4.2 - Release Notes (RealVNC)
- VNC Personal Edition 4.2 - Release Notes (RealVNC)
- Linux VNC evil client patch - BID 17978 ([email protected])
- RealVNC 4.1.1 Remote Compromise ("James Evans"
) - VNC_bypauth: vnc scanner multithreaded linux & windows ("[email protected]"
)