Title: AT&T VNC Weak Authentication Vulnerability
Severity: HIGH
Description:
VNC is the Virtual Network Computing software package, freely available from AT&T. The software package is designed to allow remote desktop access to a user that has sufficient privileges.
A problem with the software package may allow unauthorized access to the desktop of machines using the service. It is a possible for a system in a position to control data between the client and server to gain unauthorized access to a VNC connection without using means such as TCP session hijacking by exploiting a weakness in the challenge and response system between the Client and Server.
When a connection between a server (S) and client (C) are negotiated, it is possible for an intermediate system (I) to gain access to session by intercepting and exchanging data necessary to authenticate with the VNC server. (I) can first initiate a connection with (S), wait for (C) to initiate a connection with (S), and using by techniques of both intercepting and injecting data, force (C) to accept the key for the session between (S) and (I), allow (C) to authenticate the key and attempt to return it to (S). The return to (S) will be intercepted by (I) and used for it's own session. This attack fulfills the authentication requirements of (S), and allows the connection from (I), denying the connection from (C).
This makes it possible for a system with access to alter data flow between a VNC client and server to gain access to a system desktop, allowing local access to the system and potentially elevated privileges.
Affected Products:
- AT&T VNC 3.3.3
- Conectiva Linux 7.0.0
- Conectiva Linux 8.0.0
- MandrakeSoft Linux Mandrake 7.2.0
- OpenBSD OpenBSD 2.0.0
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
