VNC: Invalid Client Request

This protocol anomaly triggers when it detects a VNC client request that is sent by a VNC server. VNC servers should receive VNC requests, not send them. Triggering this protocol anomaly can indicate that the VNC client is invalid, or that the VNC client is sending nested requests to the VNC server.

Extended Description

Detection of a VNC session initiation request originating from a VNC server may indicate that a software or network transmission error has occurred. It may also indicate that a malicious user is running a nested session in an attempt to bypass access control policies and/or mask a malicious user's true originating IP address.

References

URL: http://www.realvnc.com/docs/rfbproto.pdf

Short Name

VNC:INVALID:CLIENT-REQUEST

Severity

Warning

Recommended

False

Recommended Action

Drop

VNC: Invalid Client Request

Extended Description

References

Found a potential security threat?