Stories
Slash Boxes
Comments

SoylentNews is people

SoylentNews is powered by your submissions, so send in your scoop. Only 15 submissions in the queue.

RDP Loves Company: Kaspersky Finds 37 Security Holes in VNC Remote Desktop Software

posted by Fnord666 on Saturday November 23 2019, @11:17AM   Printer-friendly
from the it's-checkers-all-the-way-down dept.

martyb writes:

RDP Loves Company: Kaspersky Finds 37 Security Holes in VNC Remote Desktop Software:

This is all according to [PDF] a team at Kaspersky Lab, which has uncovered and reported more than three dozen CVE-listed security holes, some allowing for remote code execution.

VNC, or Virtual Network Computing, is an open protocol used to remotely access and administer systems. Much like with the BlueKeep flaw in Microsoft's RDP service, miscreants can exploit these holes in VNC to potentially commandeer internet or network-facing computers.

Kaspersky says that, based on its best estimates from Shodan searches, about 600,000 public-facing machines offer VNC access as do around a third of industrial control devices.

"According to our estimates, [more] ICS vendors implement remote administration tools for their products based on VNC rather than any other system," said Kaspersky researcher Pavel Cheremushkin earlier today. "This made an analysis of VNC security a high-priority task for us."

[...] The investigation kicked up a total of 37 CVE-listed memory corruption flaws: 10 in LibVNC, four in TightVNC, one in TurboVNC, and 22 in UltraVNC. All have now been patched, save for the bugs in TightVNC 1.x which were present in a no-longer supported version: you should be using version 2.x anyway.

[...] Admins can protect themselves from RDP and VNC exploitation by updating their software (or migrating off, in the case of TightVNC) and using network filters to lock down access.

Who's in control?

Original Submission

 
This discussion has been archived. No new comments can be posted.
RDP Loves Company: Kaspersky Finds 37 Security Holes in VNC Remote Desktop Software | Log In/Create an Account | Top | 11 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 0) by Anonymous Coward on Saturday November 23 2019, @02:12PM (1 child)

    by Anonymous Coward on Saturday November 23 2019, @02:12PM (#923824)

    For centuries, in civil engineering, machine-building, electrical engineering, metallurgy, chemistry, industrial people are personally responsible for their designs and actions, often lost careers or went to jail when negligence was too costly in damages or lives.

    And for centuries before that, structures failed, see https://weburbanist.com/2014/04/16/ancient-engineering-fail-12-historic-structural-disasters/ [weburbanist.com] for some dramatic examples. From https://en.wikipedia.org/wiki/Fidenae#Stadium_disaster [wikipedia.org]

    In 27 AD, an apparently cheaply built wooden amphitheater constructed by an entrepreneur named Atilius collapsed in Fidenae, resulting in by far the worst stadium disaster in history. At least 20,000 were killed and many more injured out of the total audience of 50,000.

    It may take some time before we/humanity understand how to deal with this new stuff called software...

  • (Score: 2) by Mojibake Tengu on Saturday November 23 2019, @02:36PM

    by Mojibake Tengu (8598) on Saturday November 23 2019, @02:36PM (#923829) Journal

    Yes, this is exactly what I mean by preserving names. A history.
    The Roman Senate responded by requiring future stadiums to be inspected and certified.

    --
    Respect Authorities. Know your social status. Woke responsibly.