Sun SunPCi II VNC Software Password Disclosure Vulnerability
BID:5146
Info
Sun SunPCi II VNC Software Password Disclosure Vulnerability
| Bugtraq ID: | 5146 |
| Class: | Design Error |
| CVE: |
CVE-2002-0994 |
| Remote: | Yes |
| Local: | No |
| Published: | Jul 03 2002 12:00AM |
| Updated: | Jul 11 2009 02:56PM |
| Credit: | Discovered by Richard van den Berg <[email protected]>. |
| Vulnerable: |
Sun SunPCi II Driver Software 2.3 |
| Not Vulnerable: | |
Discussion
Sun SunPCi II VNC Software Password Disclosure Vulnerability
The SunPCi II card is a co-processor for a number of Solaris based systems, and provides PC software compatibility, including the ability to run Microsoft Windows. Driver software is available for the SunPCi card, including a Virtual Network Computing (VNC) client and server.
A weakness in the authentication scheme used by the VNC client and server may result in the disclosure of user passwords. An attacker able to sniff unencrypted network traffic during the VNC authentication process may trivially recover the plaintext password.
Exploitation will not be possible if network traffic is encrypted with an additional secure layer, such as SSL.
Reportedly, the VNC software was first included in version 2.3 of the SunPCi Driver Software.
The SunPCi II card is a co-processor for a number of Solaris based systems, and provides PC software compatibility, including the ability to run Microsoft Windows. Driver software is available for the SunPCi card, including a Virtual Network Computing (VNC) client and server.
A weakness in the authentication scheme used by the VNC client and server may result in the disclosure of user passwords. An attacker able to sniff unencrypted network traffic during the VNC authentication process may trivially recover the plaintext password.
Exploitation will not be possible if network traffic is encrypted with an additional secure layer, such as SSL.
Reportedly, the VNC software was first included in version 2.3 of the SunPCi Driver Software.
Exploit / POC
Sun SunPCi II VNC Software Password Disclosure Vulnerability
Richard van den Berg <[email protected]> has provided a program which will decrypt passwords, given sniffed data:
Richard van den Berg <[email protected]> has provided a program which will decrypt passwords, given sniffed data:
Solution / Fix
Sun SunPCi II VNC Software Password Disclosure Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.
References
Sun SunPCi II VNC Software Password Disclosure Vulnerability
References:
References: