CVE-2002-1336: TightVNC before 1.2.6 generates the same challenge string for multiple connections, which allows remote attackers to bypass VNC authentication by sniffing the challenge and… | LiveThreat CVE Feed — Verisq

Login Request a demo

Unscored severity · published Dec 11, 2002

CVE-2002-1336

TightVNC before 1.2.6 generates the same challenge string for multiple connections, which allows remote attackers to bypass VNC authentication by sniffing the challenge and…

–

CVSS

2.4%

EPSS

No

On KEV

Description

TightVNC before 1.2.6 generates the same challenge string for multiple connections, which allows remote attackers to bypass VNC authentication by sniffing the challenge and response of other users.

Exploitation

Is it being used?

Exploit prediction (EPSS)2.4% · higher than 84% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

TI

Tightvnc · Tightvnc

1.2.0; 1.2.1; 1.2.3; 1.2.4; 1.2.5 · source: NVD

Affected product

TI

Tightvnc

Tightvnc

All Tightvnc CVEs

References

https://nvd.nist.gov/vuln/detail/CVE-2002-1336

https://www.cve.org/CVERecord?id=CVE-2002-1336

distro.conectiva.com.br

http://distro.conectiva.com.br/atualizacoes/?id=a&anuncio=000640

http://marc.info/?l=bugtraq&m=102753170201524&w=2

http://marc.info/?l=bugtraq&m=102769183913594&w=2

www.mandrakesoft.com

http://www.mandrakesoft.com/security/advisories?name=MDKSA-2003:022

http://www.redhat.com/support/errata/RHSA-2002-287.html

http://www.redhat.com/support/errata/RHSA-2003-041.html

More from Tightvnc

9.8

Buffer Overflow vulnerability in tvnviewer.exe of TightVNC Viewer allows a remote attacker to execute arbitrary instructions via a crafted FramebufferUpdate packet from a VNC…

9.8

TightVNC code version 1.3.10 contains global buffer overflow in HandleCoRREBBP macro function, which can potentially result code execution

9.8

TightVNC code version 1.3.10 contains heap buffer overflow in InitialiseRFBConnection function, which can potentially result code execution

9.8

TightVNC code version 1.3.10 contains heap buffer overflow in rfbServerCutText handler, which can potentially result code execution

9.0

TightVNC before v2.8.75 allows attackers to escalate privileges on the host operating system via replacing legitimate files with crafted files when executing a file transfer