Skip to navigation

Security Advisory Updated VNC packages fix replay and cookie vulnerabilities

Advisory: RHSA-2003:041-15
Type: Security Advisory
Severity: N/A
Issued on: 2003-02-07
Last updated on: 2003-07-10
Affected Products: Red Hat Linux 7.0
Red Hat Linux 7.1
Red Hat Linux 7.1 for iSeries
Red Hat Linux 7.1 for pSeries
Red Hat Linux 7.2
Red Hat Linux 7.3
Red Hat Linux 8.0
CVEs (cve.mitre.org): CVE-2002-1336
CVE-2002-1511

Details

Updated VNC packages are available, fixing a challenge replay and a weak
cookie vulnerability.

[Updated 10 July 2003]
Added packages for Red Hat Linux on IBM iSeries and pSeries systems.

VNC is a tool for providing a remote graphical user interface. Two
vulnerabilities have been found in versions of VNC shipped by Red Hat.

The VNC server acts as an X server, but the script for starting it
generates an MIT X cookie (which is used for X authentication) without
using a sufficiently strong random number generator. This could allow an
attacker to more easily guess the authentication cookie.

The VNC DES authentication scheme is implemented using a challenge-response
architecture, producing a random and different challenge for each
authentication attempt. A bug in the function for generating the random
challenge caused the random seed to be reset to the current time on every
authentication attempt. Therefore, two authentication attempts within the
same second could receive the same challenge. An eavesdropper could
exploit this vulnerability by replaying the response, thereby gaining
authentication.

All users of VNC are advised to upgrade to these erratum packages, which
contain patches to correct these issues.

Note that when using VNC on an untrusted network, always make sure to
tunnel it through a secure authenticated protocol such as SSH.


Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains the
desired RPMs.

Please note that this update is also available via Red Hat Network. Many
people find this an easier way to apply updates. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Updated packages

Red Hat Linux 7.0

SRPMS:
ftp://updates.redhat.com/rhn/public/2703533/vnc/3.3.3r2-18.6/SRPMS/vnc-3.3.3r2-18.6.src.rpm
Missing file
    MD5: 9238c1864c7571432c232b35d4047cbd
ftp://updates.redhat.com/rhn/repository/NULL/vnc/3.3.3r2-18.6/SRPMS/vnc-3.3.3r2-18.6.src.rpm
Missing file
    MD5: 9238c1864c7571432c232b35d4047cbd
 
IA-32:
ftp://updates.redhat.com/rhn/repository/NULL/vnc/3.3.3r2-18.6/i386/vnc-3.3.3r2-18.6.i386.rpm
Missing file
    MD5: c159b4fa8ac650a799e64acbebb3934e
ftp://updates.redhat.com/rhn/repository/NULL/vnc-doc/3.3.3r2-18.6/i386/vnc-doc-3.3.3r2-18.6.i386.rpm
Missing file
    MD5: 7087a97e858bd5d38bccb4e69ce2ebdc
ftp://updates.redhat.com/rhn/repository/NULL/vnc-server/3.3.3r2-18.6/i386/vnc-server-3.3.3r2-18.6.i386.rpm
Missing file
    MD5: 678cbceba744439bca85bb3d01279e59
 
Red Hat Linux 7.1

SRPMS:
ftp://updates.redhat.com/rhn/public/2703533/vnc/3.3.3r2-18.6/SRPMS/vnc-3.3.3r2-18.6.src.rpm
Missing file
    MD5: 9238c1864c7571432c232b35d4047cbd
ftp://updates.redhat.com/rhn/repository/NULL/vnc/3.3.3r2-18.6/SRPMS/vnc-3.3.3r2-18.6.src.rpm
Missing file
    MD5: 9238c1864c7571432c232b35d4047cbd
 
IA-32:
ftp://updates.redhat.com/rhn/repository/NULL/vnc/3.3.3r2-18.6/i386/vnc-3.3.3r2-18.6.i386.rpm
Missing file
    MD5: c159b4fa8ac650a799e64acbebb3934e
ftp://updates.redhat.com/rhn/repository/NULL/vnc-doc/3.3.3r2-18.6/i386/vnc-doc-3.3.3r2-18.6.i386.rpm
Missing file
    MD5: 7087a97e858bd5d38bccb4e69ce2ebdc
ftp://updates.redhat.com/rhn/repository/NULL/vnc-server/3.3.3r2-18.6/i386/vnc-server-3.3.3r2-18.6.i386.rpm
Missing file
    MD5: 678cbceba744439bca85bb3d01279e59
 
Red Hat Linux 7.1 for iSeries

iSeries:
ftp://updates.redhat.com/rhn/repository/NULL/vnc/3.3.3r2-18.6.0p/ppc/vnc-3.3.3r2-18.6.0p.ppc.rpm
Missing file
    MD5: 0c37df8b4bfd6f1b0ce5f1e2f0dce826
ftp://updates.redhat.com/rhn/repository/NULL/vnc-doc/3.3.3r2-18.6.0p/ppc/vnc-doc-3.3.3r2-18.6.0p.ppc.rpm
Missing file
    MD5: a1e6b0da9384d56387d5d02608a46274
ftp://updates.redhat.com/rhn/repository/NULL/vnc-server/3.3.3r2-18.6.0p/ppc/vnc-server-3.3.3r2-18.6.0p.ppc.rpm
Missing file
    MD5: f98649ea169cd8418c86c8a63d918c13
 
Red Hat Linux 7.1 for pSeries

pSeries:
ftp://updates.redhat.com/rhn/repository/NULL/vnc/3.3.3r2-18.6.0p/ppc/vnc-3.3.3r2-18.6.0p.ppc.rpm
Missing file
    MD5: 0c37df8b4bfd6f1b0ce5f1e2f0dce826
ftp://updates.redhat.com/rhn/repository/NULL/vnc-doc/3.3.3r2-18.6.0p/ppc/vnc-doc-3.3.3r2-18.6.0p.ppc.rpm
Missing file
    MD5: a1e6b0da9384d56387d5d02608a46274
ftp://updates.redhat.com/rhn/repository/NULL/vnc-server/3.3.3r2-18.6.0p/ppc/vnc-server-3.3.3r2-18.6.0p.ppc.rpm
Missing file
    MD5: f98649ea169cd8418c86c8a63d918c13
 
Red Hat Linux 7.2

SRPMS:
ftp://updates.redhat.com/rhn/public/2703533/vnc/3.3.3r2-18.6/SRPMS/vnc-3.3.3r2-18.6.src.rpm
Missing file
    MD5: 9238c1864c7571432c232b35d4047cbd
ftp://updates.redhat.com/rhn/repository/NULL/vnc/3.3.3r2-18.6/SRPMS/vnc-3.3.3r2-18.6.src.rpm
Missing file
    MD5: 9238c1864c7571432c232b35d4047cbd
 
IA-32:
ftp://updates.redhat.com/rhn/repository/NULL/vnc/3.3.3r2-18.6/i386/vnc-3.3.3r2-18.6.i386.rpm
Missing file
    MD5: c159b4fa8ac650a799e64acbebb3934e
ftp://updates.redhat.com/rhn/repository/NULL/vnc-doc/3.3.3r2-18.6/i386/vnc-doc-3.3.3r2-18.6.i386.rpm
Missing file
    MD5: 7087a97e858bd5d38bccb4e69ce2ebdc
ftp://updates.redhat.com/rhn/repository/NULL/vnc-server/3.3.3r2-18.6/i386/vnc-server-3.3.3r2-18.6.i386.rpm
Missing file
    MD5: 678cbceba744439bca85bb3d01279e59
 
Red Hat Linux 7.3

SRPMS:
ftp://updates.redhat.com/rhn/repository/NULL/vnc/3.3.3r2-28.2/SRPMS/vnc-3.3.3r2-28.2.src.rpm
Missing file
    MD5: 10bbe07038a2a122affc6c5583b83c11
 
IA-32:
ftp://updates.redhat.com/rhn/repository/NULL/vnc/3.3.3r2-28.2/i386/vnc-3.3.3r2-28.2.i386.rpm
Missing file
    MD5: 535f8e6e8b531efafc3906a09a7be81e
ftp://updates.redhat.com/rhn/repository/NULL/vnc-doc/3.3.3r2-28.2/i386/vnc-doc-3.3.3r2-28.2.i386.rpm
Missing file
    MD5: cdb33d3b5367de1afe34d3b758096aa9
ftp://updates.redhat.com/rhn/repository/NULL/vnc-server/3.3.3r2-28.2/i386/vnc-server-3.3.3r2-28.2.i386.rpm
Missing file
    MD5: 40bc575df1a4360d14e0624013e89ecf
 
Red Hat Linux 8.0

SRPMS:
ftp://updates.redhat.com/rhn/repository/NULL/vnc/3.3.3r2-39.2/SRPMS/vnc-3.3.3r2-39.2.src.rpm
Missing file
    MD5: 7cf3f738c2277cdcece3076c8c629e6e
 
IA-32:
ftp://updates.redhat.com/rhn/repository/NULL/vnc/3.3.3r2-39.2/i386/vnc-3.3.3r2-39.2.i386.rpm
Missing file
    MD5: 6b20a3a761015ca503128cea711605a4
ftp://updates.redhat.com/rhn/repository/NULL/vnc-doc/3.3.3r2-39.2/i386/vnc-doc-3.3.3r2-39.2.i386.rpm
Missing file
    MD5: db2ca9e3207bb536c80f3cc360f594c6
ftp://updates.redhat.com/rhn/repository/NULL/vnc-server/3.3.3r2-39.2/i386/vnc-server-3.3.3r2-39.2.i386.rpm
Missing file
    MD5: 900346576f15c15591e67f4284b4beb0
 

Bugs fixed (see bugzilla for more information)

78828 - Upgrade to tightVNC 1.2.7 from 1.2.2


References


Keywords

challenge, cookie, mkcookie, replay, vnc


These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/