[原文]WinVNC 3.3.3 and earlier generates the same challenge string for multiple connections, which allows remote attackers to bypass VNC authentication by sniffing the challenge and response of other users.
This vulnerability was discovered by the Core SDI Team, and announced in their security advisory to Bugtraq on January 15, 2001.
-
受影响的程序版本
AT&T VNC 3.3.3
-
Apple Mac OS 9 9.0
-
BSDI BSD/OS 4.0
+
Conectiva Linux 8.0
+
Conectiva Linux 7.0
-
Conectiva Linux 6.0
-
Conectiva Linux graficas
-
Conectiva Linux ecommerce
-
Debian Linux 2.2
-
FreeBSD FreeBSD 4.2
-
HP HP-UX 11.11
+
Mandriva Linux Mandrake 7.2
-
Microsoft Windows 2000 Professional
-
Microsoft Windows 98SE
-
Microsoft Windows NT 4.0
-
OpenBSD OpenBSD 2.8
+
OpenBSD OpenBSD 2.0
-
RedHat Linux 7.0
-
S.u.S.E. Linux 7.0
-
Sun Solaris 8_sparc
-
Sun Solaris 7.0
-
漏洞讨论
VNC is the Virtual Network Computing software package, freely available from AT&T. The software package is designed to allow remote desktop access to a user that has sufficient privileges.
A problem with the software package may allow unauthorized access to the desktop of machines using the service. It is a possible for a system in a position to control data between the client and server to gain unauthorized access to a VNC connection without using means such as TCP session hijacking by exploiting a weakness in the challenge and response system between the Client and Server.
When a connection between a server (S) and client (C) are negotiated, it is possible for an intermediate system (I) to gain access to session by intercepting and exchanging data necessary to authenticate with the VNC server. (I) can first initiate a connection with (S), wait for (C) to initiate a connection with (S), and using by techniques of both intercepting and injecting data, force (C) to accept the key for the session between (S) and (I), allow (C) to authenticate the key and attempt to return it to (S). The return to (S) will be intercepted by (I) and used for it's own session. This attack fulfills the authentication requirements of (S), and allows the connection from (I), denying the connection from (C).
This makes it possible for a system with access to alter data flow between a VNC client and server to gain access to a system desktop, allowing local access to the system and potentially elevated privileges.
-
漏洞利用
Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: vuldb@securityfocus.com <mailto:vuldb@securityfocus.com>.
Follow yourself.