[Full-Disclosure] [RHSA-2003:041-12] Updated VNC packages fix replay and cookie vulnerabilities

From: bugzilla@redhat.com
Date: 02/21/03

  • Next message: debian-security-announce@lists.debian.org: "[Full-Disclosure] [SECURITY] [DSA 252-1] New slocate packages fix local root exploit"
    From: bugzilla@redhat.com
    To: redhat-watch-list@redhat.com, redhat-announce-list@redhat.com
    Date: Fri, 21 Feb 2003 03:40 -0500
    

    ---------------------------------------------------------------------
                       Red Hat, Inc. Red Hat Security Advisory

    Synopsis: Updated VNC packages fix replay and cookie vulnerabilities
    Advisory ID: RHSA-2003:041-12
    Issue date: 2003-02-07
    Updated on: 2003-02-20
    Product: Red Hat Linux
    Keywords: vnc challenge replay cookie mkcookie
    Cross references:
    Obsoletes:
    CVE Names: CAN-2002-1336 CAN-2002-1511
    ---------------------------------------------------------------------

    1. Topic:

    Updated VNC packages are available to fix a challenge replay vulnerability
    and a weak cookie vulnerability.

    2. Relevant releases/architectures:

    Red Hat Linux 7.0 - i386
    Red Hat Linux 7.1 - i386
    Red Hat Linux 7.2 - i386
    Red Hat Linux 7.3 - i386
    Red Hat Linux 8.0 - i386

    3. Problem description:

    VNC is a tool for providing a remote graphical user interface. Two
    vulnerabilities have been found in versions of VNC shipped by Red Hat.

    The VNC server acts as an X server, but the script for starting it
    generates an MIT X cookie (which is used for X authentication) without
    using a strong enough random number generator. This could allow an
    attacker to be able to more easily guess the authentication cookie.

    The VNC DES authentication scheme is implemented using a challenge-response
    architecture, producing a random and different challenge for each
    authentication attempt. A bug in the function for generating the random
    challenge caused the random seed to get reset to the current time on every
    authentication attempt. Therefore, two authentication attempts within the
    same second could receive the same challenge. An eavesdropper could
    exploit this vulnerability by replaying the response, thereby gaining
    authentication.

    All users of VNC are advised to upgrade to these erratum packages, which
    contain patches to correct these issues.

    Note that when using VNC on an untrusted network, always make sure to
    tunnel it through a secure authenticated protocol such as SSH.

    4. Solution:

    Before applying this update, make sure all previously released errata
    relevant to your system have been applied.

    To update all RPMs for your particular architecture, run:

    rpm -Fvh [filenames]

    where [filenames] is a list of the RPMs you wish to upgrade. Only those
    RPMs which are currently installed will be updated. Those RPMs which are
    not installed but included in the list will not be updated. Note that you
    can also use wildcards (*.rpm) if your current directory *only* contains the
    desired RPMs.

    Please note that this update is also available via Red Hat Network. Many
    people find this an easier way to apply updates. To use Red Hat Network,
    launch the Red Hat Update Agent with the following command:

    up2date

    This will start an interactive process that will result in the appropriate
    RPMs being upgraded on your system.

    5. Bug IDs fixed (http://bugzilla.redhat.com/bugzilla for more info):

    78828 - Upgrade to tightVNC 1.2.7 from 1.2.2

    6. RPMs required:

    Red Hat Linux 7.0:

    SRPMS:
    ftp://updates.redhat.com/7.0/en/os/SRPMS/vnc-3.3.3r2-18.6.src.rpm

    i386:
    ftp://updates.redhat.com/7.0/en/os/i386/vnc-3.3.3r2-18.6.i386.rpm
    ftp://updates.redhat.com/7.0/en/os/i386/vnc-server-3.3.3r2-18.6.i386.rpm
    ftp://updates.redhat.com/7.0/en/os/i386/vnc-doc-3.3.3r2-18.6.i386.rpm

    Red Hat Linux 7.1:

    SRPMS:
    ftp://updates.redhat.com/7.1/en/os/SRPMS/vnc-3.3.3r2-18.6.src.rpm

    i386:
    ftp://updates.redhat.com/7.1/en/os/i386/vnc-3.3.3r2-18.6.i386.rpm
    ftp://updates.redhat.com/7.1/en/os/i386/vnc-server-3.3.3r2-18.6.i386.rpm
    ftp://updates.redhat.com/7.1/en/os/i386/vnc-doc-3.3.3r2-18.6.i386.rpm

    Red Hat Linux 7.2:

    SRPMS:
    ftp://updates.redhat.com/7.2/en/os/SRPMS/vnc-3.3.3r2-18.6.src.rpm

    i386:
    ftp://updates.redhat.com/7.2/en/os/i386/vnc-3.3.3r2-18.6.i386.rpm
    ftp://updates.redhat.com/7.2/en/os/i386/vnc-server-3.3.3r2-18.6.i386.rpm
    ftp://updates.redhat.com/7.2/en/os/i386/vnc-doc-3.3.3r2-18.6.i386.rpm

    Red Hat Linux 7.3:

    SRPMS:
    ftp://updates.redhat.com/7.3/en/os/SRPMS/vnc-3.3.3r2-28.2.src.rpm

    i386:
    ftp://updates.redhat.com/7.3/en/os/i386/vnc-3.3.3r2-28.2.i386.rpm
    ftp://updates.redhat.com/7.3/en/os/i386/vnc-server-3.3.3r2-28.2.i386.rpm
    ftp://updates.redhat.com/7.3/en/os/i386/vnc-doc-3.3.3r2-28.2.i386.rpm

    Red Hat Linux 8.0:

    SRPMS:
    ftp://updates.redhat.com/8.0/en/os/SRPMS/vnc-3.3.3r2-39.2.src.rpm

    i386:
    ftp://updates.redhat.com/8.0/en/os/i386/vnc-3.3.3r2-39.2.i386.rpm
    ftp://updates.redhat.com/8.0/en/os/i386/vnc-server-3.3.3r2-39.2.i386.rpm
    ftp://updates.redhat.com/8.0/en/os/i386/vnc-doc-3.3.3r2-39.2.i386.rpm

    7. Verification:

    MD5 sum Package Name
    --------------------------------------------------------------------------
    9238c1864c7571432c232b35d4047cbd 7.0/en/os/SRPMS/vnc-3.3.3r2-18.6.src.rpm
    c159b4fa8ac650a799e64acbebb3934e 7.0/en/os/i386/vnc-3.3.3r2-18.6.i386.rpm
    7087a97e858bd5d38bccb4e69ce2ebdc 7.0/en/os/i386/vnc-doc-3.3.3r2-18.6.i386.rpm
    678cbceba744439bca85bb3d01279e59 7.0/en/os/i386/vnc-server-3.3.3r2-18.6.i386.rpm
    9238c1864c7571432c232b35d4047cbd 7.1/en/os/SRPMS/vnc-3.3.3r2-18.6.src.rpm
    c159b4fa8ac650a799e64acbebb3934e 7.1/en/os/i386/vnc-3.3.3r2-18.6.i386.rpm
    7087a97e858bd5d38bccb4e69ce2ebdc 7.1/en/os/i386/vnc-doc-3.3.3r2-18.6.i386.rpm
    678cbceba744439bca85bb3d01279e59 7.1/en/os/i386/vnc-server-3.3.3r2-18.6.i386.rpm
    9238c1864c7571432c232b35d4047cbd 7.2/en/os/SRPMS/vnc-3.3.3r2-18.6.src.rpm
    c159b4fa8ac650a799e64acbebb3934e 7.2/en/os/i386/vnc-3.3.3r2-18.6.i386.rpm
    7087a97e858bd5d38bccb4e69ce2ebdc 7.2/en/os/i386/vnc-doc-3.3.3r2-18.6.i386.rpm
    678cbceba744439bca85bb3d01279e59 7.2/en/os/i386/vnc-server-3.3.3r2-18.6.i386.rpm
    10bbe07038a2a122affc6c5583b83c11 7.3/en/os/SRPMS/vnc-3.3.3r2-28.2.src.rpm
    535f8e6e8b531efafc3906a09a7be81e 7.3/en/os/i386/vnc-3.3.3r2-28.2.i386.rpm
    cdb33d3b5367de1afe34d3b758096aa9 7.3/en/os/i386/vnc-doc-3.3.3r2-28.2.i386.rpm
    40bc575df1a4360d14e0624013e89ecf 7.3/en/os/i386/vnc-server-3.3.3r2-28.2.i386.rpm
    7cf3f738c2277cdcece3076c8c629e6e 8.0/en/os/SRPMS/vnc-3.3.3r2-39.2.src.rpm
    6b20a3a761015ca503128cea711605a4 8.0/en/os/i386/vnc-3.3.3r2-39.2.i386.rpm
    db2ca9e3207bb536c80f3cc360f594c6 8.0/en/os/i386/vnc-doc-3.3.3r2-39.2.i386.rpm
    900346576f15c15591e67f4284b4beb0 8.0/en/os/i386/vnc-server-3.3.3r2-39.2.i386.rpm

    These packages are GPG signed by Red Hat, Inc. for security. Our key
    is available at http://www.redhat.com/about/contact/pgpkey.html

    You can verify each package with the following command:
        
        rpm --checksig -v <filename>

    If you only wish to verify that each package has not been corrupted or
    tampered with, examine only the md5sum with the following command:
        
        md5sum <filename>

    8. References:

    http://marc.theaimsgroup.com/?l=bugtraq&m=102753170201524
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1336
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2002-1511

    9. Contact:

    The Red Hat security contact is <security@redhat.com>. More contact
    details at http://www.redhat.com/solutions/security/news/contact.html

    Copyright 2003 Red Hat, Inc.

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html