ID de Prueba:	1.3.6.1.4.1.25623.1.0.69793
Categoría:	Red Hat Local Security Checks
Título:	RedHat Security Advisory RHSA-2011:0871
Resumen:	NOSUMMARY
Descripción:	Description: The remote host is missing updates announced in advisory RHSA-2011:0871. Virtual Network Computing (VNC) is a remote display system which allows you to view a computer's desktop environment not only on the machine where it is running, but from anywhere on the Internet and from a wide variety of machine architectures. TigerVNC is a suite of VNC servers and clients. It was discovered that vncviewer could prompt for and send authentication credentials to a remote server without first properly validating the server's X.509 certificate. As vncviewer did not indicate that the certificate was bad or missing, a man-in-the-middle attacker could use this flaw to trick a vncviewer client into connecting to a spoofed VNC server, allowing the attacker to obtain the client's credentials. (CVE-2011-1775) All tigervnc users should upgrade to these updated packages, which contain a backported patch to correct this issue. Solution: Please note that this update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date http://rhn.redhat.com/errata/RHSA-2011-0871.html Risk factor : High CVSS Score: 5.8
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2011-1775 44939 http://secunia.com/advisories/44939 47738 http://www.securityfocus.com/bid/47738 FEDORA-2011-6838 http://lists.fedoraproject.org/pipermail/package-announce/2011-May/060567.html RHSA-2011:0871 http://www.redhat.com/support/errata/RHSA-2011-0871.html [oss-security] 20110506 CVE request: tigervnc http://openwall.com/lists/oss-security/2011/05/06/2 [oss-security] 20110509 Re: CVE request: tigervnc http://openwall.com/lists/oss-security/2011/05/09/7 [tigervnc-devel] 20110504 Re: potential vulnerability in TLS secType? http://www.mail-archive.com/tigervnc-devel%40lists.sourceforge.net/msg01345.html [tigervnc-devel] 20110504 potential vulnerability in TLS secType? http://www.mail-archive.com/tigervnc-devel%40lists.sourceforge.net/msg01342.html [tigervnc-devel] 20110505 Re: potential vulnerability in TLS secType? http://www.mail-archive.com/tigervnc-devel%40lists.sourceforge.net/msg01347.html https://bugzilla.redhat.com/show_bug.cgi?id=702470 https://bugzilla.redhat.com/show_bug.cgi?id=702672
Copyright	Copyright (c) 2011 E-Soft Inc. http://www.securityspace.com

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.