oss-security - Re: Neat VNC Security Vulnerability

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Zq6DvMRVDEMv4ZLk@eldamar.lan>
Date: Sat, 3 Aug 2024 21:23:40 +0200
From: Salvatore Bonaccorso <carnil@...ian.org>
To: Dane Bouchie <dbouchie@...dimed.com>
Cc: Solar Designer <solar@...nwall.com>, Andri Yngvason <andri@...vason.is>,
	"oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>,
	Travis Wise <travis@...esquared.com>,
	"security@...pberrypi.com" <security@...pberrypi.com>,
	Simon Long <simon@...pberrypi.com>,
	Moritz M??hlenhoff <jmm@...til.org>
Subject: Re: Neat VNC Security Vulnerability

Hi,

On Fri, Aug 02, 2024 at 02:46:48PM +0000, Dane Bouchie wrote:
> This issue is basically CVE-2006-2369
> 
> On Aug 2, 2024 10:41 AM, Dane Bouchie <dbouchie@...dimed.com> wrote:
> The client chooses the security type, so they can pass in "None" to the switch statement. is_allowed_security_type() now prevents that.

FTR, this issue has the following CVE assigned:

https://www.cve.org/CVERecord?id=CVE-2024-42458

Regards,
Salvatore

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.