Vulnerability Name:

CVE-2006-2450 (CCN-27737)

Assigned:2006-07-05
Published:2006-07-05
Updated:2022-05-13
Summary:auth.c in LibVNCServer 0.7.1 allows remote attackers to bypass authentication via a request in which the client specifies an insecure security type such as "Type 1 - None", which is accepted even if it is not offered by the server, a different issue than CVE-2006-2369.
CVSS v3 Severity:7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.5 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.5 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-Other
Vulnerability Consequences:Bypass Security
References:Source: CCN
Type: Debian Bug report logs - #376824
libvncserver: authentication bypass [CVE-2006-2450]

Source: MISC
Type: Patch
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=376824

Source: MITRE
Type: CNA
CVE-2006-2450

Source: CCN
Type: SourceForge.net CVS Repository
Diff of /libvncserver/libvncserver/auth.c

Source: CONFIRM
Type: Patch
http://libvncserver.cvs.sourceforge.net/libvncserver/libvncserver/libvncserver/auth.c?r1=1.11&r2=1.14&diff_format=u

Source: FULLDISC
Type: UNKNOWN
20220513 some details regarding CVE-2022-24422 / iDRAC VNC authentication

Source: CCN
Type: SA20940
LibVNCServer Authentication Bypass Vulnerability

Source: SECUNIA
Type: Patch, Vendor Advisory
20940

Source: SECUNIA
Type: UNKNOWN
21179

Source: SECUNIA
Type: UNKNOWN
21349

Source: CCN
Type: SA21393
x11vnc Authentication Bypass Vulnerability

Source: SECUNIA
Type: UNKNOWN
21393

Source: SECUNIA
Type: UNKNOWN
21405

Source: SECUNIA
Type: UNKNOWN
24525

Source: GENTOO
Type: UNKNOWN
GLSA-200608-05

Source: GENTOO
Type: UNKNOWN
GLSA-200608-12

Source: GENTOO
Type: UNKNOWN
GLSA-200703-19

Source: CCN
Type: SourceForge.net
LibVNCServer

Source: CONFIRM
Type: Patch
http://sourceforge.net/project/shownotes.php?release_id=431724&group_id=32584

Source: CCN
Type: GLSA-200608-05
LibVNCServer: Authentication bypass

Source: CCN
Type: GLSA-200608-12
x11vnc: Authentication bypass in included LibVNCServer code

Source: CCN
Type: GLSA-200703-19
LTSP: Authentication bypass in included LibVNCServer code

Source: SUSE
Type: UNKNOWN
SUSE-SA:2006:042

Source: BUGTRAQ
Type: UNKNOWN
20060811 Re: [ GLSA 200608-12 ] x11vnc: Authentication bypass in included LibVNCServer code

Source: BID
Type: UNKNOWN
18977

Source: CCN
Type: BID-18977
LibVNCServer Remote Authentication Bypass Vulnerability

Source: VUPEN
Type: UNKNOWN
ADV-2006-2797

Source: XF
Type: UNKNOWN
libvncserver-authentication-bypass(27737)

Source: SUSE
Type: SUSE-SA:2006:042
kernel local privilege escalation

Vulnerable Configuration:Configuration 1:
  • cpe:/a:libvncserver:libvncserver:0.7.1:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20062450
    V
    		CVE-2006-2450
    2022-06-30
    oval:org.opensuse.security:def:42258
    P
    		Security update for zlib (Important)
    2022-03-30
    oval:org.opensuse.security:def:111896
    P
    		LibVNCServer-devel-0.9.13-3.1 on GA media (Moderate)
    2022-01-17
    oval:org.opensuse.security:def:32289
    P
    		Security update for libvirt (Important)
    2022-01-10
    oval:org.opensuse.security:def:31753
    P
    		Security update for net-snmp (Important)
    2022-01-05
    oval:org.opensuse.security:def:32250
    P
    		Security update for log4j (Important)
    2021-12-17
    oval:org.opensuse.security:def:31330
    P
    		Security update for xorg-x11-server (Important)
    2021-12-14
    oval:org.opensuse.security:def:31318
    P
    		Security update for mozilla-nss (Important)
    2021-12-06
    oval:org.opensuse.security:def:31319
    P
    		Security update for openssh (Important)
    2021-12-06
    oval:org.opensuse.security:def:26177
    P
    		Security update for webkit2gtk3 (Important)
    2021-12-01
    oval:org.opensuse.security:def:31697
    P
    		Security update for opensc (Important)
    2021-10-29
    oval:org.opensuse.security:def:33032
    P
    		Security update for open-lldp (Moderate)
    2021-10-26
    oval:org.opensuse.security:def:31292
    P
    		Security update for strongswan (Important)
    2021-10-19
    oval:org.opensuse.security:def:32201
    P
    		Security update for MozillaFirefox (Important)
    2021-10-15
    oval:org.opensuse.security:def:105473
    P
    		LibVNCServer-devel-0.9.13-3.1 on GA media (Moderate)
    2021-10-01
    oval:org.opensuse.security:def:26119
    P
    		Security update for file (Important)
    2021-09-02
    oval:org.opensuse.security:def:32993
    P
    		Security update for libesmtp (Important)
    2021-09-02
    oval:org.opensuse.security:def:26113
    P
    		Security update for mysql-connector-java (Moderate)
    2021-08-30
    oval:org.opensuse.security:def:32145
    P
    		Security update for the Linux Kernel (Live Patch 37 for SLE 12 SP3) (Important)
    2021-07-21
    oval:org.opensuse.security:def:31648
    P
    		Security update for openexr (Important)
    2021-06-24
    oval:org.opensuse.security:def:26080
    P
    		Security update for libnettle (Important)
    2021-06-23
    oval:org.opensuse.security:def:31211
    P
    		Security update for the Linux Kernel (Live Patch 33 for SLE 12 SP3) (Important)
    2021-06-18
    oval:org.opensuse.security:def:31200
    P
    		Security update for java-1_8_0-openjdk (Moderate)
    2021-06-15
    oval:org.opensuse.security:def:36069
    P
    		LibVNCServer-0.9.1-154.24 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:36360
    P
    		LibVNCServer-devel-0.9.1-154.24 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:42476
    P
    		LibVNCServer-0.9.1-154.24 on GA media (Moderate)
    2021-06-08
    oval:org.opensuse.security:def:31628
    P
    		Security update for dhcp (Important)
    2021-06-01
    oval:org.opensuse.security:def:31621
    P
    		Security update for djvulibre (Important)
    2021-05-19
    oval:org.opensuse.security:def:32094
    P
    		Security update for graphviz (Critical)
    2021-05-19
    oval:org.opensuse.security:def:26044
    P
    		Security update for avahi (Moderate)
    2021-05-04
    oval:org.opensuse.security:def:42064
    P
    		Security update for libnettle (Important)
    2021-04-28
    oval:org.opensuse.security:def:32072
    P
    		Security update for xen (Important)
    2021-04-19
    oval:org.opensuse.security:def:31735
    P
    		Security update for perl-XML-Twig (Moderate)
    2021-03-01
    oval:org.opensuse.security:def:31736
    P
    		Security update for MozillaFirefox (Important)
    2021-03-01
    oval:org.opensuse.security:def:31349
    P
    		Security update for MozillaFirefox (Important)
    2021-03-01
    oval:org.opensuse.security:def:26195
    P
    		Security update for php74 (Important)
    2021-02-19
    oval:org.opensuse.security:def:31343
    P
    		Security update for bind (Important)
    2021-02-18
    oval:org.opensuse.security:def:26194
    P
    		Security update for java-1_7_1-ibm (Important)
    2021-02-18
    oval:org.opensuse.security:def:26031
    P
    		Security update for php74 (Moderate)
    2021-01-14
    oval:org.opensuse.security:def:26133
    P
    		Security update for java-1_8_0-ibm (Moderate)
    2021-01-05
    oval:org.opensuse.security:def:31685
    P
    		Security update for java-1_8_0-ibm (Moderate)
    2021-01-05
    oval:org.opensuse.security:def:32138
    P
    		Security update for openssh (Moderate)
    2021-01-05
    oval:org.opensuse.security:def:25985
    P
    		Security update for gimp (Moderate)
    2020-12-29
    oval:org.opensuse.security:def:25984
    P
    		Security update for cyrus-sasl (Important)
    2020-12-28
    oval:org.opensuse.security:def:35514
    P
    		LibVNCServer-0.9.1-154.24 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:35657
    P
    		LibVNCServer-0.9.1-154.24 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:41921
    P
    		LibVNCServer-0.9.1-154.24 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:35851
    P
    		LibVNCServer-0.9.1-154.24 on GA media (Moderate)
    2020-12-03
    oval:org.opensuse.security:def:25413
    P
    		Security update for ucode-intel (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31845
    P
    		Security update for clamav (Important)
    2020-12-01
    oval:org.opensuse.security:def:26539
    P
    		emacs on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25841
    P
    		Security update for ImageMagick (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25910
    P
    		Security update for gstreamer-0_10-plugins-base (Low)
    2020-12-01
    oval:org.opensuse.security:def:25493
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:32815
    P
    		LibVNCServer on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31125
    P
    		Security update for kvm (Important)
    2020-12-01
    oval:org.opensuse.security:def:25605
    P
    		Security update for MozillaFirefox (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31989
    P
    		Security update for java-1_7_1-ibm (Important)
    2020-12-01
    oval:org.opensuse.security:def:26627
    P
    		perl-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26514
    P
    		LibVNCServer on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25634
    P
    		Security update for java-1_7_0-openjdk (Important)
    2020-12-01
    oval:org.opensuse.security:def:31840
    P
    		Security update for bsdtar (Important)
    2020-12-01
    oval:org.opensuse.security:def:26815
    P
    		quagga on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31137
    P
    		Security update for kvm and libvirt
    2020-12-01
    oval:org.opensuse.security:def:25960
    P
    		Security update for gimp (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26685
    P
    		dhcp on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31536
    P
    		Security update for samba (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25838
    P
    		Security update for flash-player (Important)
    2020-12-01
    oval:org.opensuse.security:def:31901
    P
    		Security update for MozillaFirefox, mozilla-nss, mozilla-nspr (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25209
    P
    		Security update for mutt (Important)
    2020-12-01
    oval:org.opensuse.security:def:27358
    P
    		LibVNCServer-devel on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25618
    P
    		Security update for python3 (Important)
    2020-12-01
    oval:org.opensuse.security:def:31436
    P
    		Security update for php53 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25926
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:32583
    P
    		nagios-plugins on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25284
    P
    		Security update for xrdp (Important)
    2020-12-01
    oval:org.opensuse.security:def:26297
    P
    		Security update for libvpx (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32355
    P
    		Security update for squid3 (Important)
    2020-12-01
    oval:org.opensuse.security:def:25630
    P
    		Security update for openssl-1_0_0 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25407
    P
    		Security update for samba (Important)
    2020-12-01
    oval:org.opensuse.security:def:30983
    P
    		Security update for icu (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25686
    P
    		Security update for wicked (Important)
    2020-12-01
    oval:org.opensuse.security:def:31928
    P
    		Security update for giflib (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26350
    P
    		Security update for ansible (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25822
    P
    		Security update for ImageMagick (Important)
    2020-12-01
    oval:org.opensuse.security:def:25642
    P
    		Security update for blktrace (Low)
    2020-12-01
    oval:org.opensuse.security:def:26657
    P
    		LibVNCServer on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25065
    P
    		Security update for ucode-intel (Important)
    2020-12-01
    oval:org.opensuse.security:def:31068
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:25827
    P
    		Security update for flash-player (Critical)
    2020-12-01
    oval:org.opensuse.security:def:32033
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:27032
    P
    		squidGuard on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26251
    P
    		Security update for zziplib (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25744
    P
    		Security update for djvulibre (Low)
    2020-12-01
    oval:org.opensuse.security:def:31802
    P
    		Security update for adns (Important)
    2020-12-01
    oval:org.opensuse.security:def:25077
    P
    		Security update for clamav (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31435
    P
    		Security update for php53 (Important)
    2020-12-01
    oval:org.opensuse.security:def:25402
    P
    		Security update for libvirt (Important)
    2020-12-01
    oval:org.opensuse.security:def:26486
    P
    		Security update for pdns-recursor (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25797
    P
    		Security update for flash-player (Important)
    2020-12-01
    oval:org.opensuse.security:def:32479
    P
    		LibVNCServer on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25909
    P
    		Security update for flash-player (Important)
    2020-12-01
    oval:org.opensuse.security:def:25269
    P
    		Security update for libpng12 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31579
    P
    		Security update for supportutils (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32776
    P
    		python on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25477
    P
    		Security update for spectre-meltdown-checker (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31902
    P
    		Security update for MozillaFirefox, mozilla-nss (Important)
    2020-12-01
    oval:org.opensuse.security:def:26588
    P
    		libicu-32bit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26479
    P
    		Security update for chromium (Important)
    2020-12-01
    oval:org.opensuse.security:def:25921
    P
    		Recommended update for mariadb (Important)
    2020-12-01
    oval:org.opensuse.security:def:25550
    P
    		Security update for squid (Important)
    2020-12-01
    oval:org.opensuse.security:def:31791
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:31126
    P
    		Security update for kvm (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25903
    P
    		Security update for util-linux (Important)
    2020-12-01
    oval:org.opensuse.security:def:26641
    P
    		syslog-ng on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31535
    P
    		Security update for samba (Important)
    2020-12-01
    oval:org.opensuse.security:def:25785
    P
    		Security update for flash-player (Critical)
    2020-12-01
    oval:org.opensuse.security:def:31879
    P
    		Security update for dhcp (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26850
    P
    		LibVNCServer on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25208
    P
    		Security update for python3-requests (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27323
    P
    		xalan-j2 on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31547
    P
    		Security update for sblim-sfcb (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25887
    P
    		Security update for ImageMagick (Important)
    2020-12-01
    oval:org.opensuse.security:def:31945
    P
    		Security update for gnutls (Important)
    2020-12-01
    oval:org.opensuse.security:def:25220
    P
    		Security update for java-1_8_0-openjdk (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:26248
    P
    		Security update for freerdp (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32311
    P
    		Security update for quagga (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25619
    P
    		Security update for libmspack (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25350
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:31592
    P
    		Security update for tiff (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25940
    P
    		Security update for mariadb (Important)
    2020-12-01
    oval:org.opensuse.security:def:32622
    P
    		LibVNCServer on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30982
    P
    		Security update for icu (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25412
    P
    		Security update for gcc10 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31772
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:26336
    P
    		Security update for chromium (Important)
    2020-12-01
    oval:org.opensuse.security:def:25694
    P
    		Security update for MozillaFirefox (Important)
    2020-12-01
    oval:org.opensuse.security:def:25491
    P
    		Security update for squid (Important)
    2020-12-01
    oval:org.opensuse.security:def:26622
    P
    		openvpn on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:30994
    P
    		Security update for jasper (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25743
    P
    		Security update for libssh (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31984
    P
    		Security update for java-1_7_1-ibm (Important)
    2020-12-01
    oval:org.opensuse.security:def:26394
    P
    		Security update for chromium (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25695
    P
    		Security update for gcc9 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31758
    P
    		Security update for LibVNCServer (Important)
    2020-12-01
    oval:org.opensuse.security:def:25066
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:25978
    P
    		Security update for tcpdump, libpcap (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:27067
    P
    		LibVNCServer on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:25401
    P
    		Security update for freetype2 (Important)
    2020-12-01
    oval:org.opensuse.security:def:31404
    P
    		Security update for perl-DBI (Important)
    2020-12-01
    oval:org.opensuse.security:def:26335
    P
    		security update for go (Low)
    2020-12-01
    oval:org.opensuse.security:def:25783
    P
    		Security update for flash-player (Critical)
    2020-12-01
    oval:org.opensuse.security:def:32440
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:25141
    P
    		Security update for libvirt (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:31492
    P
    		Security update for Python
    2020-12-01
    BACK
    libvncserver libvncserver 0.7.1