Secunia

Sun has issued updated packages for VNC. These fix two older vulnerabilities, which potentially can allow malicious people to gain access to the VNC server.

1) A vulnerability has been identified in the challenge response model used by VNC, since the challenge supplied by the server is based on time and only changes once every second. This allows malicious people, who can sniff the traffic, to replay the session within the same second thus gaining access to the VNC server.

2) When acting as an XServer, VNC generates insecure cookies used for authentication. The problem is that these cookies are not generated randomly enough, enabling a malicious person to guess it and thus gain access to the VNC server.

Solution
Updated packages:
Further details available in Customer Area

Deep Links
Links available in Customer Area