CVE-2001-1422: High severity Att WinVNC vulnerability
Published Jan 23, 2001
·Updated
WinVNC 3.3.3 and earlier generates the same challenge string for multiple connections, which allows remote attackers to bypass VNC authentication by sniffing the challenge and response of other users.
Affected Software
1 affected component
Att WinVNC<=3.3.3
Event History
Jan 23, 2001
CVE Published
05:00 AM
Mar 20, 2005
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2001-1422?
CVE-2001-1422 is rated as a medium severity vulnerability due to its potential for exploitation in authentication bypass.
2
How do I fix CVE-2001-1422?
To fix CVE-2001-1422, upgrade to a version of WinVNC later than 3.3.3 where this vulnerability is addressed.
3
What does CVE-2001-1422 allow attackers to do?
CVE-2001-1422 allows attackers to bypass VNC authentication by using sniffed challenge and response strings from other users.
4
Which versions of WinVNC are affected by CVE-2001-1422?
CVE-2001-1422 affects WinVNC versions 3.3.3 and earlier.
5
Is CVE-2001-1422 easy to exploit?
CVE-2001-1422 can be considered moderately easy to exploit if an attacker has access to the network where VNC traffic can be sniffed.