Secure testing team - May 2006 - Re: Version 4.1.2

Hi

I''m now building a new vnc package with your (Martins) patch.
Thanks a lot for the help.

For testing security team:
Read more about the issue on
http://www.intelliadmin.com/blog/2006/05/vnc-flaw-proof-of-concept.html
http://it.slashdot.org/article.pl?sid=06/05/11/2344217&from=rss
http://www.freerepublic.com/focus/f-news/1630902/posts
http://www.securityfocus.com/archive/1/433994/30/0/threaded

The version will soon exist in unstable as vnc4_4.1.1+X4.3.0-10

I do not really suspect problem with the merge from unstable to testing
but I want you to be informed anyway.

// Ola

On Mon, May 15, 2006 at 01:05:29AM +0200, Martin Koegler
wrote:
> On Sun, May 14, 2006 at 08:40:54PM +0200, Ola Lundqvist wrote:
> > I''l trying to locate the sources of 4.1.2, do you know where
I can find it?
> 
> At the moment, RealVNC has removed the current sources from their homepage.
> I tried to locate them yesterday, but I found none, so I tried to locate
> the security problem myself.
> 
> In the meantime, the mailing lists have also disapeared from the RealVNC
homepage (Google
> knows some mirrors, eg. opensubscriber.com).
> 
> My impression is, that RealVNC is hidding all information (including
sources/patches)
> about the authentification bypass, as this bug is relative easy to find and
exploit, if
> you know, that it exists.
> 
> As updates are available for all RealVNC Editions (and their KVM switch),
the bugs seems
> to affect all of them. I assume, that they will therefore continue with
their information
> hiding for some time.
> 
> The only way to fix the security problem for self compiled version is my
patch at the moment,
> as far as I know.
> 
> mfg Martin K?gler
> 
-- 
 --- Ola Lundqvist systemkonsult --- M Sc in IT Engineering ----
/  ola@opalsys.net                   Annebergsslingan 37        \
|  opal@debian.org                   654 65 KARLSTAD            |
|  http://www.opal.dhs.org           Mobile: +46 (0)70-332 1551 |
\  gpg/f.p.: 7090 A92B 18FE 7994 0C36 4FE4 18A1 B1CF 0FE5 3DD9  /
 ---------------------------------------------------------------

On Mon, May 15, 2006 at 08:58:22PM +0200, Ola Lundqvist
wrote:
> I''m now building a new vnc package with your (Martins) patch.
> Thanks a lot for the help.
> 
> For testing security team:
> Read more about the issue on
> http://www.intelliadmin.com/blog/2006/05/vnc-flaw-proof-of-concept.html
> http://it.slashdot.org/article.pl?sid=06/05/11/2344217&from=rss
> http://www.freerepublic.com/focus/f-news/1630902/posts
> http://www.securityfocus.com/archive/1/433994/30/0/threaded
> 
> The version will soon exist in unstable as vnc4_4.1.1+X4.3.0-10
> 
> I do not really suspect problem with the merge from unstable to testing
> but I want you to be informed anyway.
The source for 4.1.2 is now available:
http://www.realvnc.com/pipermail/vnc-list/2006-May/054936.html

The main difference to my patch is, that they use
  if (i == secTypes.end())
to check for an invalid security type. I use
  if (*i != secType)

mfg Martin K?gler