1. CVE-Search
  2. CVE-2002-1511
ID CVE-2002-1511
Summary The vncserver wrapper for vnc before 3.3.3r2-21 uses the rand() function instead of srand(), which causes vncserver to generate weak cookies.
References
Vulnerable Configurations
  • cpe:2.3:a:att:vnc:3.3.3:*:*:*:*:*:*:*
    cpe:2.3:a:att:vnc:3.3.3:*:*:*:*:*:*:*
  • cpe:2.3:a:att:vnc:3.3.3r2:*:*:*:*:*:*:*
    cpe:2.3:a:att:vnc:3.3.3r2:*:*:*:*:*:*:*
  • cpe:2.3:a:att:vnc:3.3.4:*:*:*:*:*:*:*
    cpe:2.3:a:att:vnc:3.3.4:*:*:*:*:*:*:*
  • cpe:2.3:a:att:vnc:3.3.5:*:*:*:*:*:*:*
    cpe:2.3:a:att:vnc:3.3.5:*:*:*:*:*:*:*
  • cpe:2.3:a:att:vnc:3.3.6:*:*:*:*:*:*:*
    cpe:2.3:a:att:vnc:3.3.6:*:*:*:*:*:*:*
  • cpe:2.3:a:tightvnc:tightvnc:1.2.0:*:*:*:*:*:*:*
    cpe:2.3:a:tightvnc:tightvnc:1.2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:tightvnc:tightvnc:1.2.1:*:*:*:*:*:*:*
    cpe:2.3:a:tightvnc:tightvnc:1.2.1:*:*:*:*:*:*:*
  • cpe:2.3:a:tightvnc:tightvnc:1.2.2:*:*:*:*:*:*:*
    cpe:2.3:a:tightvnc:tightvnc:1.2.2:*:*:*:*:*:*:*
  • cpe:2.3:a:tightvnc:tightvnc:1.2.3:*:*:*:*:*:*:*
    cpe:2.3:a:tightvnc:tightvnc:1.2.3:*:*:*:*:*:*:*
  • cpe:2.3:a:tightvnc:tightvnc:1.2.4:*:*:*:*:*:*:*
    cpe:2.3:a:tightvnc:tightvnc:1.2.4:*:*:*:*:*:*:*
  • cpe:2.3:a:tightvnc:tightvnc:1.2.5:*:*:*:*:*:*:*
    cpe:2.3:a:tightvnc:tightvnc:1.2.5:*:*:*:*:*:*:*
CVSS
Base: 5.0 (as of 10-09-2008 - 19:14)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
cvss-vector via4 AV:N/AC:L/Au:N/C:P/I:N/A:N
redhat via4
advisories
  • rhsa
    id RHSA-2003:041
  • rhsa
    id RHSA-2003:068
refmap via4
bid 6905
conectiva CLSA-2003:640
confirm http://changelogs.credativ.org/debian/pool/main/v/vnc/vnc_3.3.6-3/changelog
gentoo 200302-15
mandrake MDKSA-2003:022
sunalert 56161
xf vnc-rand-weak-cookie(11384)
Last major update 10-09-2008 - 19:14
Published 03-03-2003 - 05:00
Last modified 10-09-2008 - 19:14
Back to Top