Slashdot Mirror

← Back to Stories (view on slashdot.org)

Critical Flaw Found in VNC 4.1

Posted by ryuzaki0 on from the public-desktops dept.

jblobz writes "IntelliAdmin has discovered a critical flaw that allows an attacker to control any machine running VNC 4.1. The flaw grants access without the attacker obtaining a password. The details of the vulnerability have not been released, but their website has a proof of concept that allows you to test your own VNC installation for the vulnerability"

5 of 175 comments (clear)

  1. SSH by Anonymous Coward · · Score: 5, Insightful

    You should tunnel unencrypted services like VNC over SSH anyway.

  2. Yikes! by timeOday · · Score: 5, Insightful

    Surely inspection of the vulnerability test will betray the flaw to attackers?

  3. SSH tunnels by ArbitraryConstant · · Score: 5, Insightful

    Like many services meant for users that can be expected to have a password, this is best tunneled through SSH. Access is controlled by a comparatively secure protocol and server. It's still best to patch (eg someone might get unpriviledged access to a machine and use this flaw to escalate the breach), but having a gateway that's more secure than any of the components behind it is nice. Even if the gateway itself has flaws from time to time.

    --
    I rarely criticize things I don't care about.
  4. Company sells remote control software by srh2o · · Score: 3, Insightful

    I'm a bit skeptical about the motives here when the comapany is in the business of selling Remote Control software. But, I have to agree with the other posters that talked about tunneling over ssh and only allowing connections from the localhost. I'm not sure why anyone would run VNC live on an untrusted network anyway.

  5. OS X Affected? by wo1verin3 · · Score: 3, Insightful

    Can anyone check to see if OS X's implemtation of VNC (desktop sharing) is vulnerable?