SoylentNews is people
SoylentNews
from the it's-checkers-all-the-way-down dept.
RDP Loves Company: Kaspersky Finds 37 Security Holes in VNC Remote Desktop Software:
This is all according to [PDF] a team at Kaspersky Lab, which has uncovered and reported more than three dozen CVE-listed security holes, some allowing for remote code execution.
VNC, or Virtual Network Computing, is an open protocol used to remotely access and administer systems. Much like with the BlueKeep flaw in Microsoft's RDP service, miscreants can exploit these holes in VNC to potentially commandeer internet or network-facing computers.
Kaspersky says that, based on its best estimates from Shodan searches, about 600,000 public-facing machines offer VNC access as do around a third of industrial control devices.
"According to our estimates, [more] ICS vendors implement remote administration tools for their products based on VNC rather than any other system," said Kaspersky researcher Pavel Cheremushkin earlier today. "This made an analysis of VNC security a high-priority task for us."
[...] The investigation kicked up a total of 37 CVE-listed memory corruption flaws: 10 in LibVNC, four in TightVNC, one in TurboVNC, and 22 in UltraVNC. All have now been patched, save for the bugs in TightVNC 1.x which were present in a no-longer supported version: you should be using version 2.x anyway.
[...] Admins can protect themselves from RDP and VNC exploitation by updating their software (or migrating off, in the case of TightVNC) and using network filters to lock down access.
Who's in control?
(Score: 2) by mth on Saturday November 23 2019, @04:21PM (1 child)
I'd be very surprised if even one of these vulnerabilities was put there on purpose. I'm not saying it doesn't happen, but the vast majority is honest programming mistakes instead of sabotage.
In my opinion we should stop writing huge complex systems in ways where small mistakes have big consequences. Stricter languages like Rust can help, as well as using sandboxing or capabilities to reduce the impact of an exploit.
By the way, even if you are worried about deliberately inserted vulnerabilities, you are still better off upgrading your software: if you upgrade, you are vulnerable to one specific attacker, while if you don't upgrade after the vulnerability has been published you are vulnerable to every attacker out there.
(Score: 1, Informative) by Anonymous Coward on Saturday November 23 2019, @08:34PM
ANY major project these days has a backlog of KNOWN UNFIXED BUGS numbered in HUNDREDS OF THOUSANDS and going back DECADES. If you think this does not affect security, you are naive. If you think using a hip language like Rust and DOING THE SAME THING WITH IT can help any, you are deluded.