RealVNC 4.1.1, and other products that use RealVNC such as AdderLink IP and Cisco CallManager, allows remote attackers to bypass authentication via a request in which the client specifies an insecure security type such as "Type 1 - None", which is accepted even if it is not offered by the server, as originally demonstrated using a long password.

RealVNC is susceptible to an authentication-bypass vulnerability. A malicious VNC client can cause a VNC server to allow it to connect without any authentication regardless of the authentication settings configured in the server. Exploiting this issue allows attackers to gain unauthenticated, remote access to the VNC servers.

The version of VNC server running on the remote host is affected by the following vulnerabilities :

  - A flaw exists in RealVNC due to an error when handling     password authentication. A remote attacker can exploit     this to bypass authentication by using a specially     crafted request in which the client specifies an     insecure security type (e.g., 'Type 1 - None'), which is     accepted even if not offered by the server.
    (CVE-2006-2369)

  - A flaw exists in LibVNCServer within file auth.c due to     an error when handling password authentication. A remote     attacker can exploit this to bypass authentication by     using a specially crafted request in which the client     specifies an insecure security type (e.g., 'Type 1 -     None'), which is accepted even if not offered by the     server. (CVE-2006-2450)

ID	Name	Product	Family	Type	Severity
21574	FreeBSD : vnc -- authentication bypass vulnerability (4645b98c-e46e-11da-9ae7-00123fcc6e5c)	Nessus	FreeBSD Local Security Checks	Local	high
21564	VNC Security Type Enforcement Failure Remote Authentication Bypass	Nessus	Misc.	Remote	critical

Detections

Analytics

CVE-2006-2369

critical

Tenable Plugins

high

critical