oss-security - Re: CVE request: tigervnc

Openwall GNU/*/Linux 3.0 - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Mon, 9 May 2011 14:52:03 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Cc: coley@...re.org
Subject: Re: CVE request: tigervnc

----- Original Message -----
> The vncviewer in tigervnc had X.509 certificate support added in svn
> r4200 (currently beta, slated for the 1.1.0 release). It would prompt for
> and send authentication credentials before properly validating the X.509
> certificate, which makes it susceptible to a man-in-the-middle attack.
> 
> References:
> 
> https://bugzilla.redhat.com/show_bug.cgi?id=702470
> http://www.mail-archive.com/tigervnc-devel@...ts.sourceforge.net/msg01342.html
> http://www.mail-archive.com/tigervnc-devel@...ts.sourceforge.net/msg01347.html
> 

Please use CVE-2011-1775.

Thanks.

-- 
    JB

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.