Issued:
2009-02-11
Updated:
2009-02-11

RHSA-2009:0261 - Security Advisory

Synopsis

Moderate: vnc security update

Type/Severity

Security Advisory: Moderate

Topic

Updated vnc packages to correct a security issue are now available for Red
Hat Enterprise Linux 3, 4, and 5.

This update has been rated as having moderate security impact by the Red
Hat Security Response Team.

Description

Virtual Network Computing (VNC) is a remote display system which allows you
to view a computer's "desktop" environment not only on the machine where it
is running, but from anywhere on the Internet and from a wide variety of
machine architectures.

An insufficient input validation flaw was discovered in the VNC client
application, vncviewer. If an attacker could convince a victim to connect
to a malicious VNC server, or when an attacker was able to connect to
vncviewer running in the "listen" mode, the attacker could cause the
victim's vncviewer to crash or, possibly, execute arbitrary code.
(CVE-2008-4770)

Users of vncviewer should upgrade to these updated packages, which contain
a backported patch to resolve this issue. For the update to take effect,
all running instances of vncviewer must be restarted after the update is
installed.

Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use
the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

  • Red Hat Enterprise Linux Server 5 x86_64
  • Red Hat Enterprise Linux Server 5 ia64
  • Red Hat Enterprise Linux Server 5 i386
  • Red Hat Enterprise Linux Server 4 x86_64
  • Red Hat Enterprise Linux Server 4 ia64
  • Red Hat Enterprise Linux Server 4 i386
  • Red Hat Enterprise Linux Server 3 x86_64
  • Red Hat Enterprise Linux Server 3 ia64
  • Red Hat Enterprise Linux Server 3 i386
  • Red Hat Enterprise Linux Server - Extended Update Support 5.3 x86_64
  • Red Hat Enterprise Linux Server - Extended Update Support 5.3 ia64
  • Red Hat Enterprise Linux Server - Extended Update Support 5.3 i386
  • Red Hat Enterprise Linux Server - Extended Update Support 4.7 x86_64
  • Red Hat Enterprise Linux Server - Extended Update Support 4.7 ia64
  • Red Hat Enterprise Linux Server - Extended Update Support 4.7 i386
  • Red Hat Enterprise Linux Server - AUS 5.3 x86_64
  • Red Hat Enterprise Linux Server - AUS 5.3 ia64
  • Red Hat Enterprise Linux Server - AUS 5.3 i386
  • Red Hat Enterprise Linux Workstation 5 x86_64
  • Red Hat Enterprise Linux Workstation 5 i386
  • Red Hat Enterprise Linux Workstation 4 x86_64
  • Red Hat Enterprise Linux Workstation 4 ia64
  • Red Hat Enterprise Linux Workstation 4 i386
  • Red Hat Enterprise Linux Workstation 3 x86_64
  • Red Hat Enterprise Linux Workstation 3 ia64
  • Red Hat Enterprise Linux Workstation 3 i386
  • Red Hat Enterprise Linux Desktop 5 x86_64
  • Red Hat Enterprise Linux Desktop 5 i386
  • Red Hat Enterprise Linux Desktop 4 x86_64
  • Red Hat Enterprise Linux Desktop 4 i386
  • Red Hat Enterprise Linux Desktop 3 x86_64
  • Red Hat Enterprise Linux Desktop 3 i386
  • Red Hat Enterprise Linux for IBM z Systems 5 s390x
  • Red Hat Enterprise Linux for IBM z Systems 4 s390x
  • Red Hat Enterprise Linux for IBM z Systems 4 s390
  • Red Hat Enterprise Linux for IBM z Systems 3 s390x
  • Red Hat Enterprise Linux for IBM z Systems 3 s390
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 5.3 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.7 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.7 s390
  • Red Hat Enterprise Linux for Power, big endian 5 ppc
  • Red Hat Enterprise Linux for Power, big endian 4 ppc
  • Red Hat Enterprise Linux for Power, big endian 3 ppc
  • Red Hat Enterprise Linux for Power, big endian - Extended Update Support 5.3 ppc
  • Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.7 ppc
  • Red Hat Enterprise Linux Server from RHUI 5 x86_64
  • Red Hat Enterprise Linux Server from RHUI 5 i386

Fixes

  • BZ - 471777 - VNC Free Edition 4.1.3 fixes a possible security vulnerability only present in the listening viewer. VNC Server is not compromised.
  • BZ - 480590 - CVE-2008-4770 vnc: vncviewer insufficient encoding value validation in CMsgReader::readRect

CVEs

References

Red Hat Enterprise Linux Server 5

SRPM
vnc-4.1.2-14.el5_3.1.src.rpm SHA-256: 8fdefb4f1e8a2b1b785d7cc9ae0ba6b337a066a9308e77847ab5dbef59744b79
x86_64
vnc-4.1.2-14.el5_3.1.x86_64.rpm SHA-256: b5830d279449d22c90d4e2a00c20c350bbaad05e001babf8f2a7e010d96e7ee1
vnc-server-4.1.2-14.el5_3.1.x86_64.rpm SHA-256: 629c6731290f3bf7203a8f7c62ec5c13175c9c12868cb2226ea97e5042cac65e
ia64
vnc-4.1.2-14.el5_3.1.ia64.rpm SHA-256: 0ef78b934d89169b69cbceb7aae3a93839f18eed243bc77f5d96a5c6fb464bd3
vnc-server-4.1.2-14.el5_3.1.ia64.rpm SHA-256: 668548f1952d1f387ba9a6acfb8f45058ffb782dd2154d5d75040e4b2c78fe5f
i386
vnc-4.1.2-14.el5_3.1.i386.rpm SHA-256: 357291f45a8f1d2faa549cb8ac5f291297d8a58e2ae04319347f011ed1982571
vnc-server-4.1.2-14.el5_3.1.i386.rpm SHA-256: 6f72dbfb677675b7e7a7c82d4ad25126ac695704ad358bf30980fbb33745120b

Red Hat Enterprise Linux Server 4

SRPM
vnc-4.0-12.el4_7.1.src.rpm SHA-256: 162091e17d5b93025fae0c54a361321bc15b3f58107c7f514f92a0978a1c55cc
x86_64
vnc-4.0-12.el4_7.1.x86_64.rpm SHA-256: 1f04bea78353b5cf17797708fe6cdb855854ba687ec5f3ac00b7c16082776eda
vnc-4.0-12.el4_7.1.x86_64.rpm SHA-256: 1f04bea78353b5cf17797708fe6cdb855854ba687ec5f3ac00b7c16082776eda
vnc-server-4.0-12.el4_7.1.x86_64.rpm SHA-256: 253b28357301d478623670566825b8779c5d1fbf61bb5d3bed497446f2a5eb4f
vnc-server-4.0-12.el4_7.1.x86_64.rpm SHA-256: 253b28357301d478623670566825b8779c5d1fbf61bb5d3bed497446f2a5eb4f
ia64
vnc-4.0-12.el4_7.1.ia64.rpm SHA-256: 0ded4015db164916902c322b706af6b13449716cb9c522bbca1246a2ef5f81b5
vnc-4.0-12.el4_7.1.ia64.rpm SHA-256: 0ded4015db164916902c322b706af6b13449716cb9c522bbca1246a2ef5f81b5
vnc-server-4.0-12.el4_7.1.ia64.rpm SHA-256: 09be74f875f068bf1ff92e3f204ee3c49b861af74a72b31178292a9755259c35
vnc-server-4.0-12.el4_7.1.ia64.rpm SHA-256: 09be74f875f068bf1ff92e3f204ee3c49b861af74a72b31178292a9755259c35
i386
vnc-4.0-12.el4_7.1.i386.rpm SHA-256: f32f30c955082a74acfda6330036676d6dcac763c6426d5c19758e1417b75e5b
vnc-4.0-12.el4_7.1.i386.rpm SHA-256: f32f30c955082a74acfda6330036676d6dcac763c6426d5c19758e1417b75e5b
vnc-server-4.0-12.el4_7.1.i386.rpm SHA-256: 550ab9e58855ba470ee701dae6236c5ccb299c06dbd1e5cbb552ec373f336dda
vnc-server-4.0-12.el4_7.1.i386.rpm SHA-256: 550ab9e58855ba470ee701dae6236c5ccb299c06dbd1e5cbb552ec373f336dda

Red Hat Enterprise Linux Server - Extended Update Support 4.7

SRPM
vnc-4.0-12.el4_7.1.src.rpm SHA-256: 162091e17d5b93025fae0c54a361321bc15b3f58107c7f514f92a0978a1c55cc
x86_64
vnc-4.0-12.el4_7.1.x86_64.rpm SHA-256: 1f04bea78353b5cf17797708fe6cdb855854ba687ec5f3ac00b7c16082776eda
vnc-4.0-12.el4_7.1.x86_64.rpm SHA-256: 1f04bea78353b5cf17797708fe6cdb855854ba687ec5f3ac00b7c16082776eda
vnc-server-4.0-12.el4_7.1.x86_64.rpm SHA-256: 253b28357301d478623670566825b8779c5d1fbf61bb5d3bed497446f2a5eb4f
vnc-server-4.0-12.el4_7.1.x86_64.rpm SHA-256: 253b28357301d478623670566825b8779c5d1fbf61bb5d3bed497446f2a5eb4f
ia64
vnc-4.0-12.el4_7.1.ia64.rpm SHA-256: 0ded4015db164916902c322b706af6b13449716cb9c522bbca1246a2ef5f81b5
vnc-4.0-12.el4_7.1.ia64.rpm SHA-256: 0ded4015db164916902c322b706af6b13449716cb9c522bbca1246a2ef5f81b5
vnc-server-4.0-12.el4_7.1.ia64.rpm SHA-256: 09be74f875f068bf1ff92e3f204ee3c49b861af74a72b31178292a9755259c35
vnc-server-4.0-12.el4_7.1.ia64.rpm SHA-256: 09be74f875f068bf1ff92e3f204ee3c49b861af74a72b31178292a9755259c35
i386
vnc-4.0-12.el4_7.1.i386.rpm SHA-256: f32f30c955082a74acfda6330036676d6dcac763c6426d5c19758e1417b75e5b
vnc-4.0-12.el4_7.1.i386.rpm SHA-256: f32f30c955082a74acfda6330036676d6dcac763c6426d5c19758e1417b75e5b
vnc-server-4.0-12.el4_7.1.i386.rpm SHA-256: 550ab9e58855ba470ee701dae6236c5ccb299c06dbd1e5cbb552ec373f336dda
vnc-server-4.0-12.el4_7.1.i386.rpm SHA-256: 550ab9e58855ba470ee701dae6236c5ccb299c06dbd1e5cbb552ec373f336dda

Red Hat Enterprise Linux Workstation 5

SRPM
vnc-4.1.2-14.el5_3.1.src.rpm SHA-256: 8fdefb4f1e8a2b1b785d7cc9ae0ba6b337a066a9308e77847ab5dbef59744b79
x86_64
vnc-4.1.2-14.el5_3.1.x86_64.rpm SHA-256: b5830d279449d22c90d4e2a00c20c350bbaad05e001babf8f2a7e010d96e7ee1
vnc-server-4.1.2-14.el5_3.1.x86_64.rpm SHA-256: 629c6731290f3bf7203a8f7c62ec5c13175c9c12868cb2226ea97e5042cac65e
i386
vnc-4.1.2-14.el5_3.1.i386.rpm SHA-256: 357291f45a8f1d2faa549cb8ac5f291297d8a58e2ae04319347f011ed1982571
vnc-server-4.1.2-14.el5_3.1.i386.rpm SHA-256: 6f72dbfb677675b7e7a7c82d4ad25126ac695704ad358bf30980fbb33745120b

Red Hat Enterprise Linux Workstation 4

SRPM
vnc-4.0-12.el4_7.1.src.rpm SHA-256: 162091e17d5b93025fae0c54a361321bc15b3f58107c7f514f92a0978a1c55cc
x86_64
vnc-4.0-12.el4_7.1.x86_64.rpm SHA-256: 1f04bea78353b5cf17797708fe6cdb855854ba687ec5f3ac00b7c16082776eda
vnc-server-4.0-12.el4_7.1.x86_64.rpm SHA-256: 253b28357301d478623670566825b8779c5d1fbf61bb5d3bed497446f2a5eb4f
ia64
vnc-4.0-12.el4_7.1.ia64.rpm SHA-256: 0ded4015db164916902c322b706af6b13449716cb9c522bbca1246a2ef5f81b5
vnc-server-4.0-12.el4_7.1.ia64.rpm SHA-256: 09be74f875f068bf1ff92e3f204ee3c49b861af74a72b31178292a9755259c35
i386
vnc-4.0-12.el4_7.1.i386.rpm SHA-256: f32f30c955082a74acfda6330036676d6dcac763c6426d5c19758e1417b75e5b
vnc-server-4.0-12.el4_7.1.i386.rpm SHA-256: 550ab9e58855ba470ee701dae6236c5ccb299c06dbd1e5cbb552ec373f336dda

Red Hat Enterprise Linux Desktop 5

SRPM
vnc-4.1.2-14.el5_3.1.src.rpm SHA-256: 8fdefb4f1e8a2b1b785d7cc9ae0ba6b337a066a9308e77847ab5dbef59744b79
x86_64
vnc-4.1.2-14.el5_3.1.x86_64.rpm SHA-256: b5830d279449d22c90d4e2a00c20c350bbaad05e001babf8f2a7e010d96e7ee1
vnc-server-4.1.2-14.el5_3.1.x86_64.rpm SHA-256: 629c6731290f3bf7203a8f7c62ec5c13175c9c12868cb2226ea97e5042cac65e
i386
vnc-4.1.2-14.el5_3.1.i386.rpm SHA-256: 357291f45a8f1d2faa549cb8ac5f291297d8a58e2ae04319347f011ed1982571
vnc-server-4.1.2-14.el5_3.1.i386.rpm SHA-256: 6f72dbfb677675b7e7a7c82d4ad25126ac695704ad358bf30980fbb33745120b

Red Hat Enterprise Linux Desktop 4

SRPM
vnc-4.0-12.el4_7.1.src.rpm SHA-256: 162091e17d5b93025fae0c54a361321bc15b3f58107c7f514f92a0978a1c55cc
x86_64
vnc-4.0-12.el4_7.1.x86_64.rpm SHA-256: 1f04bea78353b5cf17797708fe6cdb855854ba687ec5f3ac00b7c16082776eda
vnc-server-4.0-12.el4_7.1.x86_64.rpm SHA-256: 253b28357301d478623670566825b8779c5d1fbf61bb5d3bed497446f2a5eb4f
i386
vnc-4.0-12.el4_7.1.i386.rpm SHA-256: f32f30c955082a74acfda6330036676d6dcac763c6426d5c19758e1417b75e5b
vnc-server-4.0-12.el4_7.1.i386.rpm SHA-256: 550ab9e58855ba470ee701dae6236c5ccb299c06dbd1e5cbb552ec373f336dda

Red Hat Enterprise Linux for IBM z Systems 5

SRPM
vnc-4.1.2-14.el5_3.1.src.rpm SHA-256: 8fdefb4f1e8a2b1b785d7cc9ae0ba6b337a066a9308e77847ab5dbef59744b79
s390x
vnc-4.1.2-14.el5_3.1.s390x.rpm SHA-256: 027c2c788e324049fe2672102e8f01d4bd3cf1144b13e39798a4a6bbc6f60e75
vnc-server-4.1.2-14.el5_3.1.s390x.rpm SHA-256: 9a68cded7b24608d8b5a8a9996ae51caed7712b364b0aec631c3237163a3fe22

Red Hat Enterprise Linux for IBM z Systems 4

SRPM
vnc-4.0-12.el4_7.1.src.rpm SHA-256: 162091e17d5b93025fae0c54a361321bc15b3f58107c7f514f92a0978a1c55cc
s390x
vnc-4.0-12.el4_7.1.s390x.rpm SHA-256: 55e185000ef29ab245ea5eb2b69e38390caea5faf9792d2c2cd414c2f5211916
vnc-server-4.0-12.el4_7.1.s390x.rpm SHA-256: e5e04127a0e550cd6deabc0421d89fd8f799db54ae9adfd168c3aaf91b42260f
s390
vnc-4.0-12.el4_7.1.s390.rpm SHA-256: dfb9af3f3fc9b289d7ad67816b1e7ddded297e591ef2d214a1cfdd7181c56184
vnc-server-4.0-12.el4_7.1.s390.rpm SHA-256: 46d7c234a677ac3b8af41afec0af44a442ba337a00618aa9485f509b1c90b699

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 4.7

SRPM
vnc-4.0-12.el4_7.1.src.rpm SHA-256: 162091e17d5b93025fae0c54a361321bc15b3f58107c7f514f92a0978a1c55cc
s390x
vnc-4.0-12.el4_7.1.s390x.rpm SHA-256: 55e185000ef29ab245ea5eb2b69e38390caea5faf9792d2c2cd414c2f5211916
vnc-server-4.0-12.el4_7.1.s390x.rpm SHA-256: e5e04127a0e550cd6deabc0421d89fd8f799db54ae9adfd168c3aaf91b42260f
s390
vnc-4.0-12.el4_7.1.s390.rpm SHA-256: dfb9af3f3fc9b289d7ad67816b1e7ddded297e591ef2d214a1cfdd7181c56184
vnc-server-4.0-12.el4_7.1.s390.rpm SHA-256: 46d7c234a677ac3b8af41afec0af44a442ba337a00618aa9485f509b1c90b699

Red Hat Enterprise Linux for Power, big endian 5

SRPM
vnc-4.1.2-14.el5_3.1.src.rpm SHA-256: 8fdefb4f1e8a2b1b785d7cc9ae0ba6b337a066a9308e77847ab5dbef59744b79
ppc
vnc-4.1.2-14.el5_3.1.ppc.rpm SHA-256: ca9ee4aeba81d4c95bea244bb18def7ed9d9814cf8a17232159485882aef1c65
vnc-server-4.1.2-14.el5_3.1.ppc.rpm SHA-256: 48a1f460e9682c0e3a55480ea3a155c5bdfad942b5e801e77293e904c9253e4d

Red Hat Enterprise Linux for Power, big endian 4

SRPM
vnc-4.0-12.el4_7.1.src.rpm SHA-256: 162091e17d5b93025fae0c54a361321bc15b3f58107c7f514f92a0978a1c55cc
ppc
vnc-4.0-12.el4_7.1.ppc.rpm SHA-256: 29c9880a447013b30f339112717efe7ad86c7393402f5192aed5b660f73e6354
vnc-server-4.0-12.el4_7.1.ppc.rpm SHA-256: 1ee06727ffa1beaa654233a5a4a6621bb872b784124351c1c2cfaad56a0eba39

Red Hat Enterprise Linux for Power, big endian - Extended Update Support 4.7

SRPM
vnc-4.0-12.el4_7.1.src.rpm SHA-256: 162091e17d5b93025fae0c54a361321bc15b3f58107c7f514f92a0978a1c55cc
ppc
vnc-4.0-12.el4_7.1.ppc.rpm SHA-256: 29c9880a447013b30f339112717efe7ad86c7393402f5192aed5b660f73e6354
vnc-server-4.0-12.el4_7.1.ppc.rpm SHA-256: 1ee06727ffa1beaa654233a5a4a6621bb872b784124351c1c2cfaad56a0eba39

Red Hat Enterprise Linux Server from RHUI 5

SRPM
vnc-4.1.2-14.el5_3.1.src.rpm SHA-256: 8fdefb4f1e8a2b1b785d7cc9ae0ba6b337a066a9308e77847ab5dbef59744b79
x86_64
vnc-4.1.2-14.el5_3.1.x86_64.rpm SHA-256: b5830d279449d22c90d4e2a00c20c350bbaad05e001babf8f2a7e010d96e7ee1
vnc-server-4.1.2-14.el5_3.1.x86_64.rpm SHA-256: 629c6731290f3bf7203a8f7c62ec5c13175c9c12868cb2226ea97e5042cac65e
i386
vnc-4.1.2-14.el5_3.1.i386.rpm SHA-256: 357291f45a8f1d2faa549cb8ac5f291297d8a58e2ae04319347f011ed1982571
vnc-server-4.1.2-14.el5_3.1.i386.rpm SHA-256: 6f72dbfb677675b7e7a7c82d4ad25126ac695704ad358bf30980fbb33745120b

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.