AT&T VNC Weak Authentication Vulnerability
BID:2275
Info
AT&T VNC Weak Authentication Vulnerability
| Bugtraq ID: | 2275 |
| Class: | Design Error |
| CVE: |
CVE-2001-1422 |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 23 2001 12:00AM |
| Updated: | Jul 11 2009 04:46AM |
| Credit: | This vulnerability was discovered by the Core SDI Team, and announced in their security advisory to Bugtraq on January 15, 2001. |
| Vulnerable: |
AT&T VNC 3.3.3 |
| Not Vulnerable: | |
Discussion
AT&T VNC Weak Authentication Vulnerability
VNC is the Virtual Network Computing software package, freely available from AT&T. The software package is designed to allow remote desktop access to a user that has sufficient privileges.
A problem with the software package may allow unauthorized access to the desktop of machines using the service. It is a possible for a system in a position to control data between the client and server to gain unauthorized access to a VNC connection without using means such as TCP session hijacking by exploiting a weakness in the challenge and response system between the Client and Server.
When a connection between a server (S) and client (C) are negotiated, it is possible for an intermediate system (I) to gain access to session by intercepting and exchanging data necessary to authenticate with the VNC server. (I) can first initiate a connection with (S), wait for (C) to initiate a connection with (S), and using by techniques of both intercepting and injecting data, force (C) to accept the key for the session between (S) and (I), allow (C) to authenticate the key and attempt to return it to (S). The return to (S) will be intercepted by (I) and used for it's own session. This attack fulfills the authentication requirements of (S), and allows the connection from (I), denying the connection from (C).
This makes it possible for a system with access to alter data flow between a VNC client and server to gain access to a system desktop, allowing local access to the system and potentially elevated privileges.
VNC is the Virtual Network Computing software package, freely available from AT&T. The software package is designed to allow remote desktop access to a user that has sufficient privileges.
A problem with the software package may allow unauthorized access to the desktop of machines using the service. It is a possible for a system in a position to control data between the client and server to gain unauthorized access to a VNC connection without using means such as TCP session hijacking by exploiting a weakness in the challenge and response system between the Client and Server.
When a connection between a server (S) and client (C) are negotiated, it is possible for an intermediate system (I) to gain access to session by intercepting and exchanging data necessary to authenticate with the VNC server. (I) can first initiate a connection with (S), wait for (C) to initiate a connection with (S), and using by techniques of both intercepting and injecting data, force (C) to accept the key for the session between (S) and (I), allow (C) to authenticate the key and attempt to return it to (S). The return to (S) will be intercepted by (I) and used for it's own session. This attack fulfills the authentication requirements of (S), and allows the connection from (I), denying the connection from (C).
This makes it possible for a system with access to alter data flow between a VNC client and server to gain access to a system desktop, allowing local access to the system and potentially elevated privileges.
Solution / Fix
AT&T VNC Weak Authentication Vulnerability
References
AT&T VNC Weak Authentication Vulnerability
References:
References: