MS LOGON I/II password vuln / Using Encryption

tmorrisnc · Post by **tmorrisnc** » 2006-05-15 18:41

The SecurityFocus vulnerabilities
list has two entries, at

http://www.securityfocus.com/archive/1/432861

and

http://www.securityfocus.com/bid/17824/info

that point to a weakness in how MS Logon (I and II)
authentication challenge response is crafted.

While the first article mentions that one workaround
is to use the DSM/MSRC4 plugin, are there other
plans to address this? I've been looking at
UVNC (especially SC and SCIII) as options for
helpdesk support, but need the solution to be
secure end-to-end.

Thanks in advance!

Marscha · Post by **Marscha** » 2006-05-16 07:17

An alternative solution is in the works.
However, this will not be compatible with the current MS-Logon implementation.
I.e. you will need both vncviewer and winvnc replaced with the new version.
The viewer will still be able to connect to and old server, but with the weak protocol.

If you need a secure solution, you should definitely consider using either the encryption plugin or tunneling via SSH.