From owner-freebsd-ports-bugs@FreeBSD.ORG Tue May 16 00:10:22 2006 Return-Path: X-Original-To: freebsd-ports-bugs@hub.freebsd.org Delivered-To: freebsd-ports-bugs@hub.freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id B335C16A8C1 for ; Tue, 16 May 2006 00:10:22 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [216.136.204.21]) by mx1.FreeBSD.org (Postfix) with ESMTP id 2AB8143D45 for ; Tue, 16 May 2006 00:10:22 +0000 (GMT) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.13.4/8.13.4) with ESMTP id k4G0AMYr030632 for ; Tue, 16 May 2006 00:10:22 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.13.4/8.13.4/Submit) id k4G0AMrF030631; Tue, 16 May 2006 00:10:22 GMT (envelope-from gnats) Date: Tue, 16 May 2006 00:10:22 GMT Message-Id: <200605160010.k4G0AMrF030631@freefall.freebsd.org> To: freebsd-ports-bugs@FreeBSD.org From: James Raftery Cc: Subject: Re: ports/97313: [maintainer patch] Update net/vnc port to 4.1.2 X-BeenThere: freebsd-ports-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list Reply-To: James Raftery List-Id: Ports bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 16 May 2006 00:10:23 -0000 The following reply was made to PR ports/97313; it has been noted by GNATS. From: James Raftery To: Ion-Mihai IOnut Tetcu Cc: FreeBSD-gnats-submit@FreeBSD.org Subject: Re: ports/97313: [maintainer patch] Update net/vnc port to 4.1.2 Date: Tue, 16 May 2006 01:06:37 +0100 Hi, On 16 May 2006, at 00:12, Ion-Mihai IOnut Tetcu wrote: >>> Number: 97313 >>> Category: ports >>> Synopsis: [maintainer patch] Update net/vnc port to 4.1.2 >>> Severity: serious >>> Priority: medium >>> Responsible: freebsd-ports-bugs >>> Description: >> The patch below updates the net/vnc port from version 4.1.1 to >> version 4.1.2. >> >> 4.1.2 addresses a serious vulnerability in RealVNC. > > Please tell us what this vulnerability is and if possible provide a > vuxml entry for it as well. http://www.securityfocus.com/bid/17978 http://www.securityfocus.com/archive/1/433994/30/0/threaded A malicious VNC client can cause a VNC server to allow it to connect without any authentication regardless of the authentication settings configured in the server. VuXML below. It's my first, so please check thoroughly :) Authentication bypass vulnerability found in RealVNC vnc 4.1.1

RealVNC is susceptible to an authentication-bypass vulnerability. A malicious VNC client can cause a VNC server to allow it to connect without any authentication regardless of the authentication settings configured in the server. Exploiting this issue allows attackers to gain unauthenticated, remote access to the VNC servers.

17978 http://www.securityfocus.com/archive/1/433994/30/0/ threaded 2006-05-15 2006-05-16 Thanks, james -- Times flies like an arrow. Fruit flies like bananas.