Re: [Full-disclosure] RealVNC 4.1.1 Remote Compromise

["Kurt Seifried" <bt () seifried org>]

> How is it that even though this vulnerability has been known now for
> some time, Red Hat still has not issued a new package or security update
> that addresses this?  On RHN, the most recent package I can find is
> 4.0.0 beta and the most recent security patch for VNC dates back to
> December 2004.  Since Red Hat started distributing the package, why has
> it not been kept up with?

Probably because customers are not bugging them to much for it?  I've never 
used vnc-server on Linux or seen it used to be honest, and although it is a 
nasty problem it's easy to deal with (just firewall it to trusted systems or 
wrap a VPN around it). They are obviously aware of this issue (it was fixed 
in Fedora Core 5, reported by Mark J. Cox).

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=191692

-Kurt