4 ms·
Scans claim that server had ports open for RPC and VNC, so that's an open question. I know there was a VNC authentication bypass[1] some years back so we may j
by Natsu 11y ago
Scans claim that server had ports open for RPC and VNC, so that's an open question. I know there was a VNC authentication bypass[1] some years back so we may just have to wonder given that we don't know for sure what it ran or if anyone noticed.
[1] It was a really dumb bypass, too:
Client: The authN methods I support are: [empty list].
Server: Ok, let's just skip authN.
- thieving_magpie 11y agoI remember reading that article about the open ports and distinctly recall they left out whether or not this was a public facing. Not that it justifies anything, but it wouldn't be egregious.
- Natsu 11y agoIt was found by someone scanning the internet at large and publishing results. Someone else went through that data long, long after the fact and looked to see if they'd ever scanned her servers. Because of that background, the public was able to see the ports--they would not have appeared in the scans if they were non-public. But that doesn't mean she actually had VNC or RPC software actually listening on those ports, or that the software that was listening (whatever it might be) was actually vulnerable. It might be more likely than not that it was vulnerable--I mean, that's why security people look for things like that to begin with--but false alarms aren't exactly uncommon, either and my customers have proven to me that there's no shortage of bizarre server configurations in the wild.
- ryan-c 11y agoISTR it was more like: Server: I support the following auth methods ["password"] Client: Cool, let's use "none" Server: Okay.
- Natsu 11y agoYou could be right, it's been a long time since I looked at that one. I just remember that the client claimed not to support any authN methods and the server decided that was just fine.
- zurn 11y agoBy the same standard we should count people using SSH and TLS (really: about any given protocol) as clueless, as implementations of both have had wide impact remote vulnerabilities. I agree this all is testament to widespread cluelessness, but more on the software industry level...
- cma 11y agoDoesn't vnc use a plaintext password limited to 7 chars or something ridiculous?
- Natsu 11y agoI don't believe I claimed anyone was clueless, that they were actually vulnerable to any known issues, or even that VNC or RPC were actually running on those ports. As far as I know, nobody knows any of that.
- zurn 11y agoMea culpa. Too much firewall angst I guess!