CVE-2002-0971 Vulnerability in VNC, TightVNC, and TridiaVNC allows local users to execute arbitrary code as LocalSystem by using the Win32 Messaging System to bypass the VNC GUI and access the "Add new clients" dia...
MediumCVSS 4.6
EPSS 0.40%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Vulnerability in VNC, TightVNC, and TridiaVNC allows local users to execute arbitrary code as LocalSystem by using the Win32 Messaging System to bypass the VNC GUI and access the "Add new clients" dialogue box.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| att winvnc server | <= 3.3.3_r9 | No fix listed |
| att winvnc server | = 3.3.3_r7 | No fix listed |
| tightvnc | = 1.2.0 | No fix listed |
| tightvnc | = 1.2.1 | No fix listed |
| tightvnc | = 1.2.5 | No fix listed |
| tridiavnc | = 1.5 | No fix listed |
| tridiavnc | = 1.5.1 | No fix listed |
| tridiavnc | = 1.5.2 | No fix listed |
| tridiavnc | = 1.5.4 | No fix listed |
References
- 20020821 Win32 API 'shatter' vulnerability found in VNC-based products mailing-list
- vnc-win32-messaging-privileges(9979) vdb-entry
- 5530 vdb-entry