CVE-2002-1511 The vncserver wrapper for vnc before 3.3.3r2-21 uses the rand() function instead of srand(), which causes vncserver to generate weak cookies.
MediumCVSS 5.0
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The vncserver wrapper for vnc before 3.3.3r2-21 uses the rand() function instead of srand(), which causes vncserver to generate weak cookies.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| att vnc | = 3.3.3 | No fix listed |
| att vnc | = 3.3.3r2 | No fix listed |
| att vnc | = 3.3.4 | No fix listed |
| att vnc | = 3.3.5 | No fix listed |
| att vnc | = 3.3.6 | No fix listed |
| tightvnc | = 1.2.0 | No fix listed |
| tightvnc | = 1.2.1 | No fix listed |
| tightvnc | = 1.2.2 | No fix listed |
| tightvnc | = 1.2.3 | No fix listed |
| tightvnc | = 1.2.4 | No fix listed |
| tightvnc | = 1.2.5 | No fix listed |
References
- changelogs.credativ.org
- CLSA-2003:640 vendor-advisory
- 200302-15 vendor-advisory
- 56161 vendor-advisory
- vnc-rand-weak-cookie(11384) vdb-entry vendor-advisory
- MDKSA-2003:022 vendor-advisory
- RHSA-2003:041 patch vendor-advisory
- RHSA-2003:068 vendor-advisory
- 6905 vdb-entry