发布时间 :2001-01-23 00:00:00
修订时间 :2008-09-05 16:26:30

[原文]WinVNC 3.3.3 and earlier generates the same challenge string for multiple connections, which allows remote attackers to bypass VNC authentication by sniffing the challenge and response of other users.

[CNNVD]AT&T VNC薄弱认证漏洞(CNNVD-200101-130)

        WinVNC 3.3.3版本及之前版本生成多个连接的相同激励字符串,远程攻击者可以通过嗅探其他用户的质疑和回复来绕过VNC认证。

- CVSS (基础分值)

CVSS分值: 7.5 [严重(HIGH)]
机密性影响: PARTIAL [很可能造成信息泄露]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: PARTIAL [可能会导致性能下降或中断资源访问]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)


- OVAL (用于检测的技术细节)


- 官方数据库链接
(官方数据源) MITRE
(官方数据源) NVD
(官方数据源) CNNVD

- 其它链接及资源
(UNKNOWN)  XF  vnc-weak-authentication(5992)

- 漏洞信息

AT&T VNC薄弱认证漏洞
高危 设计错误
2001-01-23 00:00:00 2005-10-20 00:00:00
        WinVNC 3.3.3版本及之前版本生成多个连接的相同激励字符串,远程攻击者可以通过嗅探其他用户的质疑和回复来绕过VNC认证。

- 公告与补丁


- 漏洞信息

WinVNC Multiple Connection Persistent Challenge String Authentication Bypass
Remote / Network Access Authentication Management
Loss of Integrity Upgrade
Vendor Verified

- 漏洞描述

- 时间线

2001-01-23 Unknow
Unknow Unknow

- 解决方案

Upgrade to version 1.2.7 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

- 相关参考

- 漏洞作者

Unknown or Incomplete

- 漏洞信息

AT&T VNC Weak Authentication Vulnerability
Design Error 2275
Yes No
2001-01-23 12:00:00 2009-07-11 04:46:00
This vulnerability was discovered by the Core SDI Team, and announced in their security advisory to Bugtraq on January 15, 2001.

- 受影响的程序版本

AT&T VNC 3.3.3
- Apple Mac OS 9 9.0
+ Conectiva Linux 8.0
+ Conectiva Linux 7.0
- Conectiva Linux 6.0
- Conectiva Linux graficas
- Conectiva Linux ecommerce
- Debian Linux 2.2
- FreeBSD FreeBSD 4.2
- HP HP-UX 11.11
+ Mandriva Linux Mandrake 7.2
- Microsoft Windows 2000 Professional
- Microsoft Windows 98SE
- Microsoft Windows NT 4.0
- OpenBSD OpenBSD 2.8
+ OpenBSD OpenBSD 2.0
- RedHat Linux 7.0
- S.u.S.E. Linux 7.0
- Sun Solaris 8_sparc
- Sun Solaris 7.0

- 漏洞讨论

VNC is the Virtual Network Computing software package, freely available from AT&T. The software package is designed to allow remote desktop access to a user that has sufficient privileges.

A problem with the software package may allow unauthorized access to the desktop of machines using the service. It is a possible for a system in a position to control data between the client and server to gain unauthorized access to a VNC connection without using means such as TCP session hijacking by exploiting a weakness in the challenge and response system between the Client and Server.

When a connection between a server (S) and client (C) are negotiated, it is possible for an intermediate system (I) to gain access to session by intercepting and exchanging data necessary to authenticate with the VNC server. (I) can first initiate a connection with (S), wait for (C) to initiate a connection with (S), and using by techniques of both intercepting and injecting data, force (C) to accept the key for the session between (S) and (I), allow (C) to authenticate the key and attempt to return it to (S). The return to (S) will be intercepted by (I) and used for it's own session. This attack fulfills the authentication requirements of (S), and allows the connection from (I), denying the connection from (C).

This makes it possible for a system with access to alter data flow between a VNC client and server to gain access to a system desktop, allowing local access to the system and potentially elevated privileges.

- 漏洞利用

Currently the SecurityFocus staff are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: <>.

- 解决方案

- 相关参考