Bug Id
4892275

Date of Resolved Release
13-APR-2005

Impact

A vulnerability with the VNC DES authentication scheme implementation may allow a local or remote unprivileged user to gain unauthorized access to the system. The script for starting the VNC server generates a cookie (which is used for X authentication) without using a sufficiently strong random number generator.

Note: VNC is a tool for providing a remote graphical user interface.

More information on this issue is available at:

• Red Hat Advisory RHSA-2003:041-15 at: https://rhn.redhat.com/errata/RHSA-2003-041.html
• CVE CAN-2002-1511 at: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1511
• CVE CAN-2002-1336 at: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1336

Contributing Factors

This issue can occur in the following releases:

Sun Linux

• Sun Linux 5.0 (LX50) with VNC versions 3.3.3r2-18.4 or earlier

Notes: Sun Linux 5.0 is currently shipped with the Sun LX50 Server.

The VNC package version can be determined by running the following command:

    $ rpm -qa | grep -i vnc
vnc-3.3.3r2-18.4

Symptoms

There are no predictable symptoms that would indicate the described issue has been exploited.

Workaround

To work around the described issue until patches can be applied, temporarily disable VNC with the following steps:

1. To see if VNC is enabled (displayed at all run levels), use the following command:

    # /sbin/chkconfig --list vncserver
vncserver       0:off   1:off   2:off   3:on   4:on   5:on   6:off

2. Disable VNC for all run levels with the following command:

    # /sbin/chkconfig --del vncserver

Resolution

Sun Linux patches are available at: http://sunsolve.sun.com/patches/linux/security.html

Modification History
Date: 13-APR-2005

• Set State to Resolved

Product
Sun Linux 5.0






























Attachments

This solution has no attachment